On September 30, 2026, researchers from Calif published the first public proof-of-concept for the CVE-2026-86950 vulnerability — an out-of-bounds write error (CWE-787) in Apple’s CoreGraphics framework. Apple fixed the issue on September 28, stating that it “may have been used in exceptionally sophisticated attacks against specific targets” on iOS versions prior to iOS 27. The vulnerability affects iPhone, iPad and Mac; patches are available in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. We already covered this vulnerability when the patch was released — now there are new technical details and questions about a possible delivery vector.
Technical essence of the vulnerability
CoreGraphics is Apple’s system framework for 2D drawing, image rendering and PDF processing. According to the Calif researchers’ report, when they compared the binary files of iOS 26.7 and 26.7.1, they found that CoreGraphics was the only modified library, and the same fix had been applied more than 20 times across eight rasterizer functions.
The core of the bug lies in inconsistent handling of glyph coordinates when converting from floating-point format to a 32-bit fixed-point value. Two of the eight functions handled out-of-range values differently: one saturated the result, the other truncated it. This led to the glyph’s bounding box becoming narrower than it should be. CoreGraphics allocated a working buffer that was too small and then wrote data past its bounds.
According to the GitHub Advisory Database, the vulnerability received a CVSS 8.8 (High) rating. Apple does not publish CVSS scores in its advisories.
What the PoC shows — and what it does not
To trigger the bug, the researchers created a TrueType font with coordinates large enough to overflow and embedded it in a PDF file. Nested scaling of composite glyphs via the text matrix pushes the coordinates beyond the allowed limit. According to the report, the generation scripts and sample PDF are hosted in a public repository on GitHub.
One distinction is crucial here: the published PoC causes a controlled crash and demonstrates an out-of-bounds write, but does not show arbitrary code execution. The Calif researchers explicitly state that turning this primitive into a working exploit is a separate task that their analysis does not address. At the same time, Apple’s advisory states that processing a malicious file “may lead to arbitrary code execution.” This discrepancy is not a contradiction: Apple is describing the vulnerability’s potential impact, while Calif is describing the limits of their demonstration.
The researchers also note that they did not receive a sample of the exploit used in real-world attacks and cannot say how the attackers completed their exploitation chain. No network indicators, attacker identifiers or payload names have been published.
The WhatsApp hypothesis: circumstantial evidence, not proof
The question of a possible delivery vector deserves separate attention. Apple listed Meta Product Security as the source that discovered the vulnerability, which prompted Calif to look into WhatsApp. Comparing two versions of the messenger (26.37.73 and 26.38.74), the researchers found new code in the Kaleidoscope attachment scanner: the newer version checks PDF files for embedded font streams and labels suspicious ones with the tags MalformedFontProgram, UndecodableFontProgram and UnverifiedFontProgram, blocking automatic parsing of tagged files.
Calif described these changes as circumstantial evidence pointing to WhatsApp as a possible delivery vector. However, the published analysis did not test delivery via WhatsApp. Moreover, the initial version of the report contained a statement about the possibility of delivery through the messenger, but it was removed 85 minutes after publication — Calif CEO Thai Duong characterized the edit as the removal of speculation about WhatsApp.
Calif’s final wording leaves open the question of whether the vulnerability was “combined with additional vulnerabilities in WhatsApp to achieve parsing with less user interaction.” Such wording implies that the examined path would require user actions or additional vulnerabilities in the chain. WhatsApp has not published any advisories linking this bug to its products. Meta did not respond to journalists’ requests before publication.
Asymmetry in the description of affected versions
It is worth noting the asymmetry in Apple’s advisories. The company explicitly limits its description of exploitation to iOS versions prior to iOS 27, while iOS 27 and macOS Golden Gate 27 are not listed as affected. However, fixes have been released for two macOS branches — macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 — without specifying exactly which macOS versions were vulnerable. This leaves some uncertainty for administrators managing macOS fleets.
Response and timelines
CISA added CVE-2026-86950 to the KEV catalog on September 29, 2026, setting October 2 as the deadline for U.S. federal agencies. In practice, this left agencies a minimal window to apply the patch. Apple did not state whether Lockdown Mode blocks the delivery vector used in the observed attacks.
Recommendations
- Immediately update Apple devices to iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1 — the vulnerability has been confirmed as exploited in real-world attacks.
- Prioritize devices running iOS below 27 — Apple specifically confirms exploitation for these versions.
- Update WhatsApp to version 26.38.74 or later — this release adds extra checks for embedded fonts in PDF attachments, although its connection to CVE-2026-86950 has not been officially confirmed.
- For devices that cannot be updated immediately: Apple has not described any workarounds. Consider restricting processing of PDF files from untrusted sources via MDM policies.
The publication of a PoC increases the likelihood that other researchers — or attackers — will be able to reproduce and refine the out-of-bounds write primitive. For now, the PoC demonstrates only a crash, not a full exploit, but the gap between a crash primitive and working exploitation can be bridged. The only reliable measure is to install Apple’s updates released on September 28.
