CoreGraphics

A first public proof-of-concept is now available for CVE-2026-86950, a vulnerability in Apple's CoreGraphics. A malicious PDF with a crafted embedded font crashes unpatched iPhones and Macs, though no working exploit has been demonstrated. Apple patched the flaw on September 28 after targeted attacks, and CISA set an October 2 fix deadline for federal agencies under its Known Exploited Vulnerabilities catalog.