Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path

Researchers at Calif have released a working proof-of-concept for CVE-2026-86950, a CoreGraphics memory-corruption bug that Apple says was likely exploited in a highly sophisticated attack against select targeted individuals on iOS versions prior to iOS 27. The bug stems from inconsistent handling of out-of-range glyph coordinates across CoreGraphics' rasterizer functions, letting a specially crafted font embedded in a PDF trigger an out-of-bounds write and crash both iPhones and Macs; the researchers only demonstrate the crash, not full code execution. Apple fixed the issue on September 28, crediting Meta Product Security, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the next day, giving federal agencies until October 2 to patch. Because Meta was credited with the find, Calif also looked at WhatsApp's attachment scanner and found new code flagging suspicious font streams in PDFs, which it called circumstantial evidence of a possible delivery route — though an initial, more specific claim about a WhatsApp zero-click chain was quietly removed from the published writeup shortly after release, and neither WhatsApp nor Meta has confirmed any connection.