Cybersecurity
Researchers publish proof-of-concept for Apple CoreGraphics flaw
Security researchers released a public proof-of-concept for CVE-2026-86950 after Apple patched the CoreGraphics bug, while Calif separately examined WhatsApp changes that might relate to delivery.
- Security researchers published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw.
- Apple patched the issue on 28 September and said it may have been used against specific targeted individuals on iPhones before iOS 27.
- The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its exploitation catalogue the next day and set 2 October as the deadline for federal agencies.
- Calif said a crafted PDF with an embedded font could trigger a crash on macOS and iOS through CoreGraphics, but not full code execution.
- Calif said its WhatsApp review found new PDF font checks, but it did not demonstrate a delivery path and an earlier WhatsApp claim was later removed.
Dion Blazakis, Josh Maine and Anna Groza of Calif published the analysis on 30 September after starting from a public comparison of iOS 26.7 and 26.7.1. They said the bug was in CoreGraphics, where different handling of out-of-range glyph coordinates led to a buffer being sized too small and then written past.
Their proof-of-concept used a TrueType font with very large coordinates inside a PDF and caused a crash on both macOS and iOS. Calif also posted the generation scripts and a sample PDF in a public GitHub repository.
Apple said it fixed the issue on 28 September and credited Meta Product Security with the discovery. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its list of known exploited vulnerabilities the following day and told federal agencies to apply the fix by 2 October.
Calif examined WhatsApp because Meta Product Security had been credited with finding the flaw. It said WhatsApp 26.38.74 added checks for PDF font streams, but the published analysis did not test a delivery path through WhatsApp.
An earlier version of the analysis had suggested WhatsApp could deliver a malicious PDF, but Calif chief executive Thai Duong later removed that sentence. The published piece said WhatsApp had issued no advisory linking its products to the flaw, and Meta did not respond to a request for comment before publication.
Named in this story
People
- Dion Blazakis
- co-authored the published analysis
- Josh Maine
- co-authored the published analysis
- Anna Groza
- co-authored the published analysis
- Thai Duong
- Calif chief executive who removed the WhatsApp speculation
Companies
- Apple
- patched the flaw and said it may have been used in attacks
- Calif
- published the analysis and proof-of-concept
Organisations
- Meta Product Security
- was credited by Apple with finding the flaw
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency
- added the flaw to its known-exploited list and set a patch deadline
Products and systems
- CoreGraphics
- Apple framework where the patched bug sat
- ImageIO
- thumbnail path used by the crash harness
- messaging app Calif examined as a possible delivery route
- Kaleidoscope attachment scanner
- WhatsApp code that now checks PDF font streams
How the source tells it
The piece was mostly neutral technical reporting, with cautious speculation about WhatsApp clearly marked rather than played for drama.
No emotive framing was found in the original.