From 1fa250dc3f622dfb28a5b47cf2f9045bf9cb6f23 Mon Sep 17 00:00:00 2001 From: Thai Duong Date: Wed, 30 Sep 2026 12:46:05 -0700 Subject: [PATCH] Remove the WhatsApp speculation --- MADBugs/CVE-2026-86950/the-great-glyph-grift.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MADBugs/CVE-2026-86950/the-great-glyph-grift.md b/MADBugs/CVE-2026-86950/the-great-glyph-grift.md index 79051e3..88a5322 100644 --- a/MADBugs/CVE-2026-86950/the-great-glyph-grift.md +++ b/MADBugs/CVE-2026-86950/the-great-glyph-grift.md @@ -2,7 +2,7 @@ Apple recently released iOS 26.7.1 to fix a bug in CoreGraphics ([CVE-2026-86950](https://support.apple.com/en-us/149226)). The security advisory stated that the vulnerability was reported by Meta Product Security and "may have been exploited in an extremely sophisticated attack against specific targeted individuals." For those who are unfamiliar with Apple’s English dialect, it means that the bug was *actually* exploited in the wild. As usual, Apple provides no meaningful technical information for our curious minds. Well, the research team at Calif has an unusual affinity for zero-click attacks (check out [WeWorm](https://calif.io/research/weworm)) so we decided to investigate the bug and share the details with everyone. -Through patch analysis, we identified a unit conversion error introduced by a compiler optimization. A malicious PDF containing a specially crafted font can trigger the bug during rendering. When CoreGraphics estimates how much memory it needs to draw a letter, the bug could break the arithmetic leading to an undersized allocation. It then draws using positions outside that memory, causing an out-of-bounds write. Our analysis suggests that WhatsApp could deliver such a PDF and trigger the vulnerability when the victim opens a chat containing it from a trusted contact, with automatic media downloads enabled. We provide a simple [PoC](https://github.com/califio/publications/tree/main/MADBugs/CVE-2026-86950) that triggers the bug on both macOS and iOS. +Through patch analysis, we identified a unit conversion error introduced by a compiler optimization. A malicious PDF containing a specially crafted font can trigger the bug during rendering. When CoreGraphics estimates how much memory it needs to draw a letter, the bug could break the arithmetic leading to an undersized allocation. It then draws using positions outside that memory, causing an out-of-bounds write. We provide a simple [PoC](https://github.com/califio/publications/tree/main/MADBugs/CVE-2026-86950) that triggers the bug on both macOS and iOS. ## What Changed in 26.7.1?