CVE-2026-86950: CoreGraphics Integer Overflow

Exploitation framework for CVE-2026-86950, a critical integer overflow in Apple's CoreGraphics anti-aliasing rasterizer affecting iOS 26.7 and macOS 26.7.

Vulnerability

Integer overflow in aa_double_to_fixed() during font rendering triggers out-of-bounds heap write via corrupted bounding box calculations. Exploitable through malicious TrueType fonts in PDFs.

• CVSS: 9.6 (Critical)
• Status: Patched in iOS/macOS 26.7.1+
• Delivery: PDF with embedded font (WhatsApp, iMessage, Preview.app)

Files

Exploitation Framework

• exploit_full.py — macOS exploit generator (font + PDF + ROP chain)
• exploit_ios.py — iOS variant (reduced complexity, 5-level scaling)
• leak_extractor.py — Parse crash dumps, ASLR bypass calculation
• rop_builder.py — ARM64 ROP gadget chain construction

Artifacts

• CVE-2026-86950_ArXiv.pdf — Full technical paper (20 pages, peer-ready)
• exploit.ttf / ios_exploit.ttf — Malicious fonts (composite glyph chaining)
• exploit.pdf / ios_exploit.pdf — Trigger PDFs with embedded fonts
• cve_2026_86950_payload.bin — ARM64 ROP chain binary

Documentation

• ACADEMIC_PAPER.md — Markdown source of research paper
• ATTRIBUTION.md — Author credits and references
• QUICK_START.txt — 5-minute setup guide
• Makefile — Build configuration
• run_exploit.sh — Automated 6-stage pipeline

Quick Start

Generate macOS Artifacts

python3 exploit_full.py .
# Outputs: exploit.ttf, exploit.pdf, Makefile

Generate iOS Artifacts

python3 exploit_ios.py .
# Outputs: ios_exploit.ttf, ios_exploit.pdf, ios_payload.bin

Extract ASLR Leak

python3 leak_extractor.py crash.log
# Parse lldb output, calculate library bases

Build ROP Chain

python3 rop_builder.py 0x0000000192200000
# Generate: cve_2026_86950_payload.bin

Run Full Pipeline (macOS)

make -C . all
make -C . run  # Requires lldb debugger

Exploitation Stages

1. Font Crafting — Generate malicious TrueType with composite glyph scaling (1.99994^7 ≈ 127x)
2. PDF Embedding — Embed font, render 256 heap-spray glyphs
3. Trigger — Invoke CGImageSourceCreateThumbnailAtIndex() → crash with OOB write
4. Leak Extraction — Parse crash dump, extract register values → ASLR bypass (theoretical)
5. Heap Corruption — Craft payload to corrupt malloc metadata (theoretical)
6. Code Execution — ARM64 ROP chain for shell execution (theoretical)

Stages 4-6 require real gadget discovery via Ghidra/IDA Pro on CoreGraphics binaries.

Technical Details

The Flaw

int32_t aa_double_to_fixed(double px) {
    double v = 0.5 + 4096.0 * px;  // No overflow check
    return (int32_t)v;               // Cast overflow
}

Overflow when px > 524,288 pixels. ARM64 differential: FCVTZS saturates to INT32_MAX, but vector XTN truncates → bounding box inversion → undersized heap allocation.

Exploitation Path

1. Stack 7 levels of composite glyph scaling → 127x magnification
2. Trigger aa_double_to_fixed() overflow in rendering pipeline
3. Corrupted bbox causes undersized coverage buffer allocation
4. Write past heap bounds, corrupt adjacent malloc metadata
5. Use corrupted pointer to hijack control flow → ROP chain → code execution

Platform Differences

	macOS	iOS
Delivery	Direct PDF	PDF attachment (Messages/WhatsApp)
Process	Preview.app	ImageIO daemon (sandboxed)
Scaling Levels	7	5 (memory limit)
Privilege	User	Daemon (sandbox escape needed)

Scope & Limitations

✅ Covers:

• Vulnerability analysis & root cause
• Font crafting with overflow triggers
• PDF embedding & heap grooming
• Crash dump parsing & ASLR concepts
• Complete technical documentation

⚠️ Requires external research:

• Real gadget discovery (Stages 4-6) — binary analysis + version-specific offsets
• iOS sandbox escape — chaining with additional CVEs
• Device validation — testing on real hardware/simulator

Responsible Disclosure

Research provided for:

• ✅ Educational purposes
• ✅ Authorized security testing & pentesting
• ✅ Academic vulnerability analysis

Unauthorized exploitation is illegal.

References

• Apple Security Advisory - CVE-2026-86950
• The Hacker News - Apple CoreGraphics PoC

---

Author: 34zY
Date: October 2026
Status: Patched, educational framework

Disclaimer: This project is for authorized security testing only. Unauthorized access to computer systems is illegal.