Ethical Hacking News
Zero-Day Vulnerability in Apple CoreGraphics: A Sophisticated Attack Awaits
Apple has patched a zero-day vulnerability in its CoreGraphics library, which has raised concerns among security experts about the potential for targeted attacks. The vulnerability, tracked as CVE-2026-86950, is an out-of-bounds write that can lead to arbitrary code execution when the system processes a specially crafted file. Security experts are urging users to update their devices as soon as possible to patch the vulnerability. The latest development in this story is the publication of the first public proof-of-concept (PoC) for the vulnerability, which raises the urgency for anyone who hasn’t patched yet. Stay tuned for further updates on this developing story.
Apple patched a zero-day vulnerability in CoreGraphics library, CVE-2026-86950, which can lead to arbitrary code execution. The vulnerability affects iOS 26.7 and earlier, iPadOS 26.7 and earlier, and macOS versions before iOS 27 and macOS Sequoia. A maliciously crafted file can trigger the vulnerability, which can be exploited in targeted attacks. Updating to the latest iOS and macOS versions is the only fix, as the vulnerability is within the OS rendering stack. Security experts urge users to update their devices immediately to patch the vulnerability.
Apple has recently patched a zero-day vulnerability in its CoreGraphics library, which has raised concerns among security experts about the potential for targeted attacks. The vulnerability, tracked as CVE-2026-86950, is an out-of-bounds write that can lead to arbitrary code execution when the system processes a specially crafted file. The flaw affects iOS 26.7 and earlier versions before iOS 27, as well as iPadOS 26.7 and earlier, and supported versions of macOS Tahoe and macOS Sequoia.
According to Apple's advisory, processing a maliciously crafted file may lead to arbitrary code execution. The company is aware of a report that this issue may have been exploited in an "extremely sophisticated attack against specific targeted individuals" on versions of iOS before iOS 27. However, Apple has not disclosed who was targeted, how many people were affected, whether the attacks succeeded, or when exploitation started.
The vulnerability is not a bug that can be mitigated with better input sanitization on the user's own app, since the flaw sits inside the OS rendering stack itself. Updating is the fix, full stop. The researchers at Calif published a proof-of-concept (PoC) that triggers the bug on macOS and iOS, and the code causes a crash, not an execution error. Turning the memory corruption into a working exploit is separate work that the analysis does not demonstrate.
The trigger for the vulnerability is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs. The code causes a crash, not an execution error. The researchers noticed that Meta had quietly added stricter PDF validation to WhatsApp's attachment-scoring system, including new checks that flag malformed or unverifiable embedded fonts. This is a strong hint about the delivery format: a booby-trapped font inside a PDF, sent as an attachment.
CoreGraphics' rasterizer is used everywhere fonts get drawn on Apple platforms, which means the attack surface isn't limited to one app. Anywhere a file gets automatically rendered into a thumbnail or preview is a potential trigger, no user interaction required beyond receiving the file. This is the whole appeal of zero-click bugs to attackers and the whole nightmare for defenders.
The patch ensures the scaled value can never exceed the size of a 32-bit signed integer using manual clamping, avoiding the undefined behavior entirely. The bug was in CoreGraphics, specifically in the code that smooths the edges of letters and other shapes. CoreGraphics converts floating-point coordinates into a fixed-point format, dividing each pixel into a 4096 × 4096 grid of smaller units.
The more important sentence, however, is the one that turns this from another vulnerability disclosure into a security incident worth watching. Apple says it knows of a report that the flaw may have been exploited in an "extremely sophisticated attack against specific targeted individuals" running versions of iOS before iOS 27.
Security experts are urging users to update their devices as soon as possible to patch the vulnerability. The PoC code is now circulating publicly, which raises the urgency for anyone who hasn’t patched yet. This is not a bug you can mitigate with better input sanitization on your own app, since the flaw sits inside the OS rendering stack itself. Updating is the fix, full stop.
Related Information:
https://www.ethicalhackingnews.com/articles/Zero-Day-Vulnerability-in-Apple-CoreGraphics-A-Sophisticated-Attack-Awaits-ehn.shtml
https://securityaffairs.com/200175/hacking/public-poc-released-for-apple-coregraphics-zero-day-cve-2026-86950.html
Published: Thu Oct 1 08:14:51 2026 by llama3.2 3B Q4_K_M
