Public Proof-of-Concept Published for Apple CoreGraphics Vulnerability CVE-2026-86950

Security researchers have published the first public proof-of-concept (PoC) code for CVE-2026-86950, a vulnerability in Apple's CoreGraphics processing engine. The flaw involves a crafted embedded font within a malicious PDF file that triggers memory corruption when processed by unpatched iOS and macOS devices.

According to Apple's security advisory, the vulnerability may have been used in attacks against specific targeted individuals prior to public disclosure. The company has released security updates addressing CVE-2026-86950; users are strongly advised to update to the latest iOS and macOS versions.

The published PoC triggers a crash (denial-of-service condition) by exploiting the memory corruption issue. As of the PoC release, there is no confirmed demonstration of reliable remote code execution being achieved in the wild, though Apple's advisory references the possibility of prior exploitation. The trigger vector is a maliciously crafted PDF, with headline context referencing WhatsApp as a potential delivery mechanism, though no public confirmation links this specific CVE to WhatsApp-based attacks.

Affected products include iOS and macOS. Apple has addressed the issue in recent security updates. Details remain preliminary, and the full exploitation chain has not been confirmed.