Forward from: HackTricksFeed
Summary CVE-2026-86950 The Great Glyph Grift.pdf
π± iOS/macOS | π‘οΈ CVE-2026-86950 | π£ OOB Write | π PoC
π Original article: https://calif.io/research/the-great-glyph-grift
CVE-2026-86950 is a CoreGraphics out-of-bounds write in Apple glyph rendering. A malicious PDF embeds a TrueType font whose transformed coordinates overflow the 4096-subpixel double-to-int32_t conversion. Different ARM64 callers handle the overflow differently, corrupting the glyph bounding box and undersizing the scanline coverage buffer. Rendering then writes outside the stack or heap allocation. The PoC crashes macOS and iOS; no reliable RCE is shown. iOS 26.7.1 adds NaN handling and clamping.
π Original article: https://calif.io/research/the-great-glyph-grift
CVE-2026-86950 is a CoreGraphics out-of-bounds write in Apple glyph rendering. A malicious PDF embeds a TrueType font whose transformed coordinates overflow the 4096-subpixel double-to-int32_t conversion. Different ARM64 callers handle the overflow differently, corrupting the glyph bounding box and undersizing the scanline coverage buffer. Rendering then writes outside the stack or heap allocation. The PoC crashes macOS and iOS; no reliable RCE is shown. iOS 26.7.1 adds NaN handling and clamping.