Apple's High-Risk Zero-Day Vulnerability Exposed: WhatsApp File Reception Can Attack iPhones Without User Interaction
On September 30, cybersecurity research institute Califf published a report revealing a high-risk zero-day vulnerability (CVE-2026-86950) in Apple's system. Apple released an emergency iOS 26.7.1 update to fix this issue, reported by Meta's security team. Attackers can embed malicious PDF files with specially crafted fonts via WhatsApp, triggering the attack upon file reception. The vulnerability lies in Apple's CoreGraphics graphics rendering engine, causing an integer underflow error. Meta reinforced WhatsApp's security, and Apple fixed the underlying unit conversion logic. Officials urge Apple users to upgrade immediately.17 sourcesSee all sources