CVE-2026-86950: Apple CoreGraphics Glyph Zero-Day Exploited in Targeted Spyware Attacks

• 1
  Pre-disclosure (date undisclosed) — Attacks observed in the wild against specific individuals on iOS versions prior to iOS 27. Meta's product security team identifies the underlying CoreGraphics flaw and reports it to Apple.
• 2
  Sep 28, 2026 — Apple releases iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, crediting the fix and acknowledging possible exploitation in "an extremely sophisticated attack." NVD publishes CVE-2026-86950.
• 3
  Sep 29, 2026 — CISA adds CVE-2026-86950 to the Known Exploited Vulnerabilities catalog, setting a federal remediation deadline of October 2.
• 4
  Oct 1, 2026 — Calif publishes "The Great Glyph Grift," a full root-cause writeup, plus a public PoC harness that generates a crashing PDF/font pair. Reporting notes Meta quietly hardened WhatsApp's PDF attachment validation around the same window.
• 5
  Oct 1, 2026 onward — SANS ISC and multiple outlets flag the PoC and the possible WhatsApp delivery path, raising the odds of copycat crash and exploit-development activity.

The PoC ships a minimal PDF that embeds a crafted TrueType font. When CoreGraphics rasterizes a glyph from that font, the overflow fires. A PDF is an ideal carrier: it travels as an innocuous attachment and is auto-previewed by many apps without an explicit "open."

Around the patch window, Meta quietly tightened WhatsApp's attachment-scoring to flag malformed or unverifiable embedded fonts in PDFs. That is a strong tell that a font-in-PDF was a real delivery path, though no source confirms WhatsApp was the exploited channel for this specific CVE.

Messaging Preview

Chat apps that render document thumbnails or inline PDF previews reach CoreGraphics before any tap.

Mail & QuickLook

Mail attachment previews and Finder QuickLook both invoke the system render path for PDFs and fonts.

Web / Safari

Web content embedding a crafted font or PDF is drawn through the same rasterizer stack.

CoreGraphics' anti-aliased rasterizer uses a 4096×4096 sub-pixel box model. Floating-point coordinates become fixed-point through an inline helper that scales by 4096 and rounds:

On its own this looks fine. The problem is what the compiler emits for that (int32_t)v cast in different surrounding code — and whether v can be pushed outside the int32 range (±2,147,483,647) by a hostile glyph.

When the scaled double exceeds int32 bounds, the narrowing cast is undefined behavior — and the compiler is free to lower it differently in different functions. On ARM64 the two call sites diverge:

Same source line, same input, two different integers. A scalar path saturates; a vectorized path converts-then-truncates. The glyph's start point and its line segments now disagree about where they are in fixed-point space.

The diverging coordinates flow into aa_add_edges, which tracks the path's bounding box by comparing consecutive points. When one endpoint carries a wrapped int32, the delta subtraction overflows and the wrong branch is taken — so the box fails to expand to cover the real extent of the glyph:

Result: a bounding box that reports a glyph as far narrower than it truly is.

In aa_cache_render, the width in pixels is derived straight from that corrupted box, and the per-scanline coverage buffer is sized from it:

An artificially small width_px yields a buffer too small for the edges the rasterizer is about to process. The allocation can land on the heap (malloc) or the stack (alloca) depending on size — giving an attacker a choice of corruption primitive.

As the rasterizer walks scanlines accumulating 16-bit alpha-coverage values, the real path edges extend past the undersized buffer. It keeps writing coverage increments beyond the allocation — a controlled out-of-bounds write. In the PoC this surfaces as an EXC_BAD_ACCESS crash; in a real exploit it is the primitive you build a chain on.

The published harness generates a minimal PDF and a matching TrueType font that reliably crash unpatched iPhones and Macs. The repository includes font-generation scripts, a sample harness and a Makefile to build the crashing files. The researchers are explicit: this is a crash, not code execution — "going from this to code execution is another exercise entirely."

Weaponization means turning the undersized-buffer OOB write into a controlled primitive, defeating ASLR and modern iOS allocator mitigations, and chaining to a sandbox escape — the kind of engineering a well-resourced spyware vendor already demonstrated in the attacks Apple cites. A public crash PoC lowers the bar for others to start that work and raises the near-term risk of copycat denial-of-service abuse. Patch posture is the only reliable defense.

Who gets hit

Journalists, dissidents, executives and officials — low-volume, high-value targeting, not mass campaigns.

How it arrives

A message or attachment that renders automatically; the parser does the attacker's work on preview.

Why parsers

Image/font/PDF decoders are enormous, shared, and run before any trust decision — ideal zero-click surface.

Update every Apple device to a fixed build and force it through MDM. There is no configuration workaround for a memory-corruption bug in a system renderer.

• 1
  iOS / iPadOS → 26.7.1
• 2
  macOS Tahoe (26.x) → 26.7.1
• 3
  macOS Sequoia (15.x) → 15.8.1

For the exact population this bug targets — executives, journalists, officials, anyone plausibly of interest to a mercenary operator — enable Lockdown Mode. It strips risky attachment and preview handling and has repeatedly blunted this bug class, making it meaningfully harder to reach the vulnerable parser.

• 1
  Enforce minimum-OS compliance in MDM; quarantine devices below the fixed builds from sensitive resources.
• 2
  Detonate inbound PDFs with embedded fonts in a sandbox before delivery to high-risk mailboxes.
• 3
  Keep WhatsApp and other messaging apps current — Meta's added PDF-font validation only protects updated clients.
• 4
  Collect iOS/macOS crash reports centrally so rasterizer faults are visible to the SOC, not stuck on the device.