https://www.msuiche.com/tags/cve-2026-86950/Recent content in CVE-2026-86950 on Matt SuicheHugoen-usTue, 27 Oct 2026 00:00:00 +0100https://www.msuiche.com/posts/the-great-glyph-grift-and-how-to-detect-it-without-the-sample/Tue, 27 Oct 2026 00:00:00 +0100https://www.msuiche.com/posts/the-great-glyph-grift-and-how-to-detect-it-without-the-sample/<p>Calif&rsquo;s write-up on <a href="https://calif.io/research/the-great-glyph-grift" target="_blank" rel="noopener">CVE-2026-86950, The Great Glyph Grift</a>, by Dion Blazakis, Josh Maine and Anna Groza, is the kind of patch-analysis work I enjoy most: take a one-line advisory from Apple, &ldquo;may have been exploited in an extremely sophisticated attack against specific targeted individuals,&rdquo; and reconstruct the entire exploit chain from binary diffs of CoreGraphics and a changelog in WhatsApp&rsquo;s attachment checker. The bug is a unit conversion error inside Apple&rsquo;s anti-aliased path rasterizer, reached through TrueType glyph rendering, exploited in the wild, credited to Meta Product Security, and fixed in iOS 26.7.1 / macOS 26.7.1.</p>