Apple Core Graphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path
Summary: Researchers at Calif published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw triggered by a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs; Apple patched it September 28, crediting Meta Product Security, and CISA added it to its Known Exploited Vulnerabilities catalog the next day with a federal fix deadline of October 2. The published code causes a controlled out-of-bounds write but not code execution, and Calif's comparison of WhatsApp versions 26.37.73 and 26.38.74 found new font-scanning code in its Kaleidoscope attachment scanner, which the firm called circumstantial evidence of a possible delivery vector.
Bottom line: A sentence describing a WhatsApp zero-click delivery path was removed from Calif's post 85 minutes after publication by CEO Thai Duong, and Calif says it never obtained the in-the-wild sample or knows how the attacker completed the chain - so the delivery mechanism behind an attack Apple says hit specific targeted individuals remains unconfirmed.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-86950
- Related
- CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Sep 29, 2026