Researchers release crash demonstration for patched Apple PDF flaw

Image: Primary

Published Thursday, October 1, 2026 · 4:06 AM EDT

Security researchers at Calif published a public proof of concept on September 30 for CVE-2026-86950, an Apple CoreGraphics flaw that Apple says may have been used against targeted individuals. A PDF containing a crafted font crashes unpatched systems; the researchers report effects on iPhones and Macs. The flaw causes Apple's graphics framework to allocate a buffer too small for a glyph and write outside it. Calif released generation scripts and a sample PDF, but did not demonstrate code execution or a WhatsApp delivery path. Apple patched the flaw on September 28. CISA added it to its Known Exploited Vulnerabilities catalog the following day, requiring federal agencies to apply the fix by October 2.

Sources

The Hacker News

In this story

Meta Apple US Government

Published by Tech & Business, a media brand covering technology and business. This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

Capital

Edelbyte emerges from stealth with $70 million in funding

Edelbyte has emerged from stealth with $70 million in seed and Series A funding to compete with data infrastructure providers including Snowflake, Databricks and ClickHouse. Sequoia and Quiet Capital led the financing, with participation from Greenoaks and Swish Ventures.

Security

TSMC confirms employee data leak linked to cloud provider

TSMC confirmed that personal information belonging to current and former employees was published online without authorization.

Capital

Nidus raises $30M across pre-seed and seed rounds

Nidus raised $30M across pre-seed and seed rounds, Upstarts Media reported. Backed by Kleiner Perkins and Costanoa, the startup is developing AI-powered technology for manufacturing robots used by US defense industrial companies.

Policy

Judge allows DRAM antitrust case against three chipmakers to proceed

Judge Noël Wise denied Micron, Samsung and SK hynix's motion to dismiss a proposed class action alleging that they coordinated restrictions on DRAM memory supply.

Capital

TSMC plans $500 million fund for chip startups and suppliers

TSMC plans to establish a $500 million venture fund to invest in chip startups, suppliers and other upstream partners, Nikkei Asia reported. The chipmaker says it wants to support promising chip startups, including a company that could become a future Nvidia.

Infrastructure

Vulcan launch failure destroys 40 Amazon Leo satellites

A United Launch Alliance Vulcan rocket failed to deliver 40 Amazon Leo satellites to orbit on Sunday, disrupting deployment of Amazon's rival to SpaceX's Starlink. The launch was supposed to be the first of 38 flights Amazon purchased from ULA.