Apple has patched a critical flaw in CoreGraphics — the framework behind font rendering and PDF handling on iPhone, iPad and Mac — after confirming it was used in a small number of highly targeted attacks.
What happened
CVE-2026-86950 was fixed in Apple's September 28, 2026 security updates. Apple credited Meta's Product Security team with the discovery and said the flaw may have been exploited in an "extremely sophisticated attack" against specific individuals running versions before iOS 27.
The bug itself lives in CoreGraphics' font rasterizer. When converting a glyph's coordinates from floating-point to a fixed-point value, two internal functions handled out-of-range numbers inconsistently — one rounded, the other truncated. That mismatch let CoreGraphics calculate a drawing buffer too small for the glyph it was about to render, opening the door to an out-of-bounds write.
A security research firm found the flaw independently by comparing the binaries of iOS 26.7 and 26.7.1, and published working proof-of-concept generation scripts and a sample malicious PDF. Their work shows the bug reliably crashes unpatched iPhones and Macs; turning that crash into full code execution is separate, harder work that hasn't been publicly demonstrated.
CISA added CVE-2026-86950 to its Known Exploited Vulnerabilities catalog the day after Apple's patch, giving US federal agencies until October 2 to update. Apple has not listed iOS 27 or macOS "Golden Gate 27" as affected, and has not published a workaround for devices that cannot update right away.
A possible WhatsApp connection
Because Meta's Product Security team is credited with the find, researchers also looked at WhatsApp itself. Comparing two recent app builds, they found a new check in WhatsApp's attachment scanner that specifically flags malformed or unverifiable font data inside incoming PDFs and blocks it from being processed automatically.
That overlap is circumstantial, not proof. An early version of the research suggested WhatsApp could deliver a triggering PDF automatically when a victim opened a chat with auto-download enabled — but that specific claim was pulled from the report less than 90 minutes after publication. WhatsApp has not issued any advisory linking this CVE to its app, and Meta has not confirmed WhatsApp's role in the real-world attacks Apple referenced.
It wouldn't be the first time the two have been chained together: in August 2025, a WhatsApp device-sync flaw was reportedly combined with a separate Apple memory-corruption bug in an operation against fewer than 200 targeted users. That precedent makes a similar chain plausible here — without confirming one exists.
Why it matters
Apple's own language — attacks against "specific targeted individuals" — points to mercenary-spyware-style targeting rather than mass exploitation. But the vulnerable code path is universal: any app that renders a PDF or displays an embedded font, from Mail to a chat app's media preview, touches CoreGraphics. With a working crash proof-of-concept now public, the barrier to further research — by defenders or attackers — has dropped.
What to do
- Update all iPhones, iPads and Macs to the September 28, 2026 security release now — this is an actively exploited, KEV-listed flaw.
- High-risk users — journalists, activists, executives, anyone who could be individually targeted — should turn on Lockdown Mode as a precaution; Apple hasn't said whether it would have stopped this specific attack chain.
- Treat unexpected PDFs and font or attachment files, including ones arriving over messaging apps, with the same suspicion as an unsolicited executable.
- Keep messaging apps updated — attachment-scanning improvements like the one found in WhatsApp here often ship quietly, ahead of any public advisory.