Affected Systems
Apple CoreGraphics on iOS versions before iOS 27 and macOS Golden Gate 27. Vulnerability triggered via malicious PDF with crafted embedded TrueType font. Affects iPhones and Macs running unpatched iOS 26.7 and earlier, macOS versions prior to Golden Gate 27.
Exploitation Status
Active in-the-wild exploitation confirmed by Apple against specific targeted individuals. Public proof-of-concept published September 30, 2026 by Calif researchers. PoC demonstrates crash via memory corruption; full exploit chain not publicly available. CISA added to KEV catalog September 29, 2026.
Business Impact
Memory corruption flaw in PDF rendering allows out-of-bounds write when processing malicious PDF with crafted font. Apple confirmed use in extremely sophisticated attacks against targeted individuals. WhatsApp PDF delivery is suspected but unconfirmed vector based on Meta Product Security credit and new Kaleidoscope scanner checks in WhatsApp 26.38.74. No workaround available for systems unable to patch. Federal agencies required to patch by October 2, 2026 per CISA KEV directive. Crash primitive exists; weaponization into code execution requires additional work not demonstrated in public PoC.
Urgency
🔴 Immediate
Recommended Actions
- Apply Apple security updates released September 28, 2026: iOS 27 and macOS Golden Gate 27 for all iPhones and Macs immediately
- Prioritize patching for high-value targets and executives given confirmed targeted exploitation
- Monitor WhatsApp usage logs and PDF attachment delivery if WhatsApp is deployed; consider blocking automatic media downloads until patching is complete
- Review endpoint detection logs for crashes in CoreGraphics, ImageIO, or PDF rendering processes on iOS and macOS devices from mid-September onward
- Inventory devices running iOS 26.7 or earlier and macOS versions prior to Golden Gate 27; enforce patch compliance by October 2 per CISA directive