CVE-2026-86950: The CoreGraphics Glyph Bug That Hit iPhones
Security firm Calif on Tuesday published a full technical breakdown of CVE-2026-86950, the CoreGraphics zero-day Apple silently patched in iOS 26.7.1, tracing the in-the-wild bug to an integer overflow in the font glyph rasterizer and identifying a credible WhatsApp-delivered PDF as the likely attack format. Apple disclosed the flaw on September 29, crediting Meta Product…












