Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteA public proof of concept (PoC) reportedly makes an unpatched Apple device crash when it processes a specially crafted PDF, but it has not demonstrated code execution. WhatsApp’s newer checks for suspicious PDF fonts have prompted questions about a possible delivery route; published evidence does not show that WhatsApp delivered the file or that the flaw could be triggered without a tap. Apple says CVE-2026-86950 may have been exploited in a highly targeted attack and released fixes on September 28, 2026.
What CVE-2026-86950 is
Apple identifies CVE-2026-86950 as an out-of-bounds write in CoreGraphics, a framework used to process graphics and documents. Apple says processing a maliciously crafted file may lead to arbitrary code execution, and describes its fix as improved bounds checking. Apple credits Meta Product Security with discovering the issue.
As an Amazon Associate I earn from qualifying purchases.
Apple’s September 28, 2026 security advisory says it is aware of a report that the issue “may have been exploited in an extremely sophisticated attack against specific targeted individuals” on versions of iOS before iOS 27. The wording is qualified: Apple does not publicly name victims, give a target count or incident date, or describe the full attack chain.
What the public PoC demonstrates
The Hacker News’ account of Calif’s analysis describes a malicious PDF containing a crafted embedded font that triggers a crash on an unpatched Apple device. That is evidence of a crash trigger, not a published demonstration of arbitrary code execution or a complete exploit.
#1 Best Overall
- FAST SPEEDS - Scans color and black and white documents a blazing speed up to 16ppm (1). Color scanning won’t slow you down as the color scan speed is the same as the black and white scan speed.
- ULTRA COMPACT – At less than 1 foot in length and only about 1. 5lbs in weight you can fit this device virtually anywhere (a bag, a purse, even a pocket).
- READY WHENEVER YOU ARE – The DS-640 mobile scanner is powered via an included micro USB 3. 0 cable allowing you to use it even where there is no outlet available. Plug it into you PC or laptop and you are ready to scan.
- WORKS YOUR WAY – Use the Brother free iPrint&Scan desktop app for scanning to multiple “Scan-to” destinations like PC, Network, cloud services, Email and OCR. (2) Supports Windows, Mac and Linux and TWAIN/WIA for PC/ICA for Mac/SANE drivers. (3)
- OPTIMIZE IMAGES AND TEXT – Automatic color detection/adjustment, image rotation (PC only), bleed through prevention/background removal, text enhancement, color drop to enhance scans. Software suite includes document management and OCR software. (4)
According to that report, the researchers compared iOS 26.7 with 26.7.1 and traced the flaw to floating-point glyph coordinates being converted to 32-bit fixed-point values. A glyph bounding box that was too narrow could lead to an undersized buffer and an out-of-bounds write. The report attributes more than 20 related code changes across eight rasterizer functions to the comparison; those implementation details are the researchers’ analysis, not figures published by Apple.
The report also describes a test harness using an ImageIO thumbnail path resembling a way to preview a received attachment. It cites a macOS debugger stack and says the iOS crash was Calif’s claim, without a separately published iOS trace. This does not establish that every PDF preview—or every messaging app—triggers the vulnerability.
Rank #2
- Flatbed scanners simply cannot compete with your smartphone and a Scanner Bin. Improved resolution and color rendering compared to popular flatbed scanners. Compare to 1200 DPI. Takes a fraction of the time to scan at a fraction of the cost. Not to mention that flatbed scanners end up adding a lot of hazardous e-waste to your local landfill.
- Solve the common issues with smartphone scanning. Provides a contrasting background for consistent edge-detection and auto-cropping. Controls the lighting and provides stability and proper positioning while you scan with your smartphone.
- Scan photographs, receipts, letters, notes, artwork, fragile documents, etc. Also used as an aid for the blind or visually impaired or as a document camera for remote learning. When you aren't scanning, turn on its side to use as a desk-side bin to toss in the items you want to scan later.
- This version is the lowest cost option for a scanner solution. It is also simplified for set up and use, and therefore is recommended for those who are blind, visually impaired or have movement disorders.
- Use with popular FREE APPS for document scanning like Adobe Scan, Scanbot, Evernote Scannable, CamScanner, and Prizmo Go
What is known about WhatsApp—and what is not
After Apple credited Meta Product Security, Calif examined WhatsApp versions 26.37.73 and 26.38.74, The Hacker News reported. In the newer version, the researchers found that WhatsApp’s Kaleidoscope attachment scanner reads PDFs for embedded font streams, assigns tags to suspicious fonts, and gives a file with any such tag a high-risk score that stops automatic parsing.
That finding is circumstantial evidence of a possible connection, not proof of delivery. The published account does not describe or test a CVE-2026-86950 attack sent through WhatsApp. It says an earlier sentence speculating about a PDF being delivered when a recipient opened a chat with automatic media downloads enabled was removed 85 minutes after publication; Calif CEO Thai Duong described the change as removing WhatsApp speculation. The Hacker News reported that Meta had not responded before publication and that WhatsApp had not issued an advisory linking the CVE to its product.
Rank #3
- FITS SMALL SPACES AND STAYS OUT OF THE WAY. Innovative space-saving design to free up desk space, even when it's being used
- SCAN DOCUMENTS, PHOTOS, CARDS, AND MORE. Handles most document types, including thick items and plastic cards. Exclusive QUICK MENU lets you quickly scan-drag-drop to your favorite computer apps
- GREAT IMAGES EVERY TIME, NO EXPERIENCE REQUIRED. A single touch starts fast, up to 30ppm duplex scanning with automatic de-skew, color optimization, and blank page removal for outstanding results without driver setup
- SCAN WHERE YOU WANT, WHEN YOU WANT. Connect with USB or Wi-Fi. Send to Mac, PC, mobile devices, and cloud services. Scan to Chromebook using the mobile app. Can be used without a computer
- PHOTO AND DOCUMENT ORGANIZATION MADE EFFORTLESS. ScanSnap Home all-in-one software brings together all your favorite functions. Easily manage, edit, and use scanned data from documents, receipts, business cards, photos, and more
Meta’s January 2026 engineering explanation describes Kaleidoscope more generally as checks for malformed structures, higher-risk file types, and indicators such as PDFs with embedded files or scripting. Meta says this defense-in-depth layer can mitigate attacks but does not stop every attack. That description does not establish that the checks were added for this Apple flaw or that WhatsApp was involved in the reported attacks.
| Claim | What the available evidence supports |
|---|---|
| Apple vulnerability and potential impact | Apple says CVE-2026-86950 is an out-of-bounds write; processing a malicious file may lead to arbitrary code execution. Its advisory says the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27. |
| Public PoC | The Hacker News’ account of Calif’s analysis reports a crafted-font PDF crash. It does not demonstrate code execution. |
| WhatsApp delivery or zero-click trigger | Not established by the published analysis. The WhatsApp font-scanning observation alone does not show that the app delivered or automatically processed an exploit PDF. |
Which Apple updates address the flaw
Apple’s security advisories dated September 28, 2026 list these releases and supported device families:
Rank #4
- PORTABLE SCANNER FOR USE ON-THE-GO — The fastest and lightest mobile single-sheet-fed compact document scanner in its class¹
- QUICK DOCUMENT SCANNING ― This Epson ultra-fast scanner scans a single page as quickly as 5.5 seconds²; Windows and Mac compatible
- VERSATILE PAPER HANDLING ― Portable scanner scans documents up to 8.5 x 72 in; Also easily digitizes receipts and ID cards to make accounting, bookkeeping, and organizing simpler
- INTUITIVE, HIGH-SPEED SOFTWARE — Epson ScanSmart Software³ is a smart tool allowing you to easily scan, review, and save; Stay organized easily with the help of this Epson scanner
- EASY SETUP — USB-powered connect to your computer for quick and simple scanning; No batteries or external power supply required to operate portable document scanner; Standard Connectivity: USB 2.0
| Apple platform | Patched release listed | Supported devices stated in the advisory |
|---|---|---|
| iOS and iPadOS | 26.7.1 | iPhone 11 and later; iPad Pro 12.9-inch (3rd generation and later); iPad Pro 11-inch (1st generation and later); iPad Air (3rd generation and later); iPad (8th generation and later); and iPad mini (5th generation and later). |
| macOS Tahoe | 26.7.1 | Macs running macOS Tahoe. |
| macOS Sequoia | 15.8.1 | Macs running macOS Sequoia. |
Install the applicable Apple software update and check the installed OS version against Apple’s current security release information; availability can change. Updating WhatsApp does not patch Apple’s CoreGraphics framework. No workaround for systems unable to update immediately is specified in the reporting covered here.
Why WhatsApp’s past security incident is not proof of this route
In August 2025, WhatsApp said a different vulnerability in linked-device synchronization messages, CVE-2025-55177, may have been chained with Apple’s separate ImageIO vulnerability CVE-2025-43300 in targeted attacks. The Hacker News reported that WhatsApp sent in-app threat notifications to fewer than 200 users who may have been targeted in that separate incident. It provides historical context for why researchers may examine a messaging-app route; it is not evidence of WhatsApp involvement in CVE-2026-86950.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
