CVE-2026-86950

CVE-2026-86950 is an out-of-bounds write in CoreGraphics font rendering, reported by Meta and patched after what Apple calls an extremely sophisticated attack on specific individuals. A public proof of concept has since appeared: a PDF with a crafted font that reliably corrupts memory on anything not updated.

1 article — 2026-10-05

Authoritative record

Root Notes reports on this identifier; it does not maintain it. For the vendor advisory, the affected versions and the scoring, NVD and MITRE hold the primary records.

Our coverage

Apple's font bug was used against a handful of people, and the proof of concept now crashes any unpatched iPhone

2026-10-05Gadgets

../cve — every identifier we have covered