AI Weekly Malaysia

On September 30, Dion Blazakis, Josh Maine, and Anna Groza of Calif published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw triggered by a PDF carrying a crafted embedded TrueType font whose glyph coordinates overflow during conversion to 32-bit fixed-point. Apple patched it September 28 — iOS 26.7.1 was the only library changed, and the same fix was applied more than 20 times across eight rasterizer functions — crediting Meta Product Security and saying it may have been used in an 'extremely sophisticated attack against specific targeted individuals' on iOS versions before iOS 27; CISA added it to the Known Exploited Vulnerabilities catalog the next day with an October 2 deadline for federal agencies. The published code crashes unpatched iPhones and Macs but does not demonstrate code execution, and no workaround was described for systems that cannot update immediately.

Why: If you ship iOS or macOS apps that render untrusted PDFs or fonts, the concrete decision is: confirm your users are on iOS 26.7.1 or later, because there is no described workaround for anyone stuck on older builds. The root cause is more useful than the CVE itself — two of eight near-identical rasterizer functions handled out-of-range glyph coordinates differently (one saturated, one truncated), producing a bounding box too narrow and an undersized buffer. If you own any float-to-fixed-point or unit-conversion code, that saturate-vs-truncate split, and the fact that one fix had to be duplicated 20+ times, is a specific review target.