Source: thehackernews.com
A public proof-of-concept (PoC) has been released for CVE-2026-86950, a vulnerability in Apple's CoreGraphics framework affecting iPhones and Macs. The flaw is triggered by a malicious PDF containing a crafted embedded font, causing memory corruption and a crash on unpatched devices. Apple has acknowledged the vulnerability may have been exploited in targeted attacks against specific individuals. WhatsApp's PDF handling behavior has been flagged as a potential delivery mechanism for the exploit. The PoC currently causes a crash rather than achieving full code execution, but researchers are working on converting the memory corruption into a functional exploit. The vulnerability is considered high severity given Apple's warning about active in-the-wild targeting. Users and organizations using unpatched Apple devices are advised to apply available patches promptly.
