dandri/http2-bomb
1
0 Fork 0
mirror of https://github.com/califio/publications.git synced 2026-10-22 13:12:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove the WhatsApp speculation

Browse Source
This commit is contained in:
Thai Duong committed 2026-09-30 12:46:05 -07:00
1 parent 5aa54df777
commit 1fa250dc3f
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
MADBugs/CVE-2026-86950/the-great-glyph-grift.md
+1 -1
View File
@@ -2,7 +2,7 @@
Apple recently released iOS 26.7.1 to fix a bug in CoreGraphics ([CVE-2026-86950](https://support.apple.com/en-us/149226)). The security advisory stated that the vulnerability was reported by Meta Product Security and "may have been exploited in an extremely sophisticated attack against specific targeted individuals." For those who are unfamiliar with Apple’s English dialect, it means that the bug was *actually* exploited in the wild. As usual, Apple provides no meaningful technical information for our curious minds. Well, the research team at Calif has an unusual affinity for zero-click attacks (check out [WeWorm](https://calif.io/research/weworm)) so we decided to investigate the bug and share the details with everyone.
Through patch analysis, we identified a unit conversion error introduced by a compiler optimization. A malicious PDF containing a specially crafted font can trigger the bug during rendering. When CoreGraphics estimates how much memory it needs to draw a letter, the bug could break the arithmetic leading to an undersized allocation. It then draws using positions outside that memory, causing an out-of-bounds write. Our analysis suggests that WhatsApp could deliver such a PDF and trigger the vulnerability when the victim opens a chat containing it from a trusted contact, with automatic media downloads enabled. We provide a simple [PoC](https://github.com/califio/publications/tree/main/MADBugs/CVE-2026-86950) that triggers the bug on both macOS and iOS.
Through patch analysis, we identified a unit conversion error introduced by a compiler optimization. A malicious PDF containing a specially crafted font can trigger the bug during rendering. When CoreGraphics estimates how much memory it needs to draw a letter, the bug could break the arithmetic leading to an undersized allocation. It then draws using positions outside that memory, causing an out-of-bounds write. We provide a simple [PoC](https://github.com/califio/publications/tree/main/MADBugs/CVE-2026-86950) that triggers the bug on both macOS and iOS.
## What Changed in 26.7.1?