Apple CoreGraphics PoC Reveals PDF Exploit Path

Researchers have published a proof-of-concept for CVE-2026-86950, a CoreGraphics flaw in Apple’s PDF processing that crashes unpatched iPhones and Macs. The vulnerability, patched on September 28, was linked to targeted attacks. The analysis shows the flaw involves memory corruption via a malicious PDF with a crafted embedded font, though turning it into a working exploit requires additional work. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply the fix by October 2.