A PDF looks like a flat page. Inside it is a small program’s worth of instructions for drawing text and pictures, and a phone follows them before the owner sees anything. In the last week of September 2026 that routine work became the subject of an Apple security fix.
Our assessment: the file is the easy part to miss
Public discussion tends to blur two things: a PDF that carries phishing, and a PDF that carries an exploit. The first is common and needs the owner to act. The second is rare and needs a flaw in the software that draws the page. The Lab’s assessment is that the second kind matters less for its frequency than for the evidence problem it creates: the file may be deleted, the message may be deleted, and what remains is small.
Why renderers are targets
A renderer has to accept untrusted input in dozens of formats and handle damaged files without failing. Fonts, images and compression schemes are old, intricate and written in languages that allow memory errors. In the FORCEDENTRY attack, analyzed by Google’s Project Zero, an iMessage file named like an image was in fact a PDF. The phone identified it by content, and a flaw in a decoder gave code execution with no user interaction[S6]. CISA listed that flaw, CVE-2021-30860, as exploited on 3 November 2021[S2].
The pattern recurs. Citizen Lab’s analysis of BLASTPASS described a zero-click chain on a fully patched iOS 16.6 that used attachments containing malicious images[S9]. Kaspersky’s account of Operation Triangulation described an iMessage attachment of about 242 KB that triggered code with no interaction, after which the message and exploit were deleted[S7].
Describe this figure
A PDF container holding pages, an embedded font and an embedded image. An arrow from a viewer or preview process leads into the font decoder and the image decoder, which is where the documented flaws have been found.
What Apple said in September 2026
On 28 September 2026 Apple released iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. They fix an out-of-bounds write in CoreGraphics, the system graphics and PDF rendering engine, tracked as CVE-2026-86950. Apple’s wording is "Processing a maliciously crafted file may lead to arbitrary code execution." Apple said it was aware of a report that the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27 [S1][S10]. Meta’s product security team is credited with the report. That credit does not mean a Meta app was the channel.
CISA added the flaw to its catalog of known exploited vulnerabilities on 29 September[S2]. Apple’s notes do not list iOS 27 as affected. They also do not say whether iOS 27 carries the same fix, and they do not say whether Lockdown Mode blocks the attack [S1][S3].
Describe this figure
Timeline from 14 to 30 September 2026 with four markers: 14 September iOS 27 released; 28 September Apple fixes the flaw in iOS 26.7.1 and says it may have been exploited; 29 September CISA lists it; 30 September Calif publishes analysis and a proof-of-concept file.
What researchers published afterward
On 30 September Calif compared iOS 26.7 with 26.7.1, located the change in the engine’s glyph drawing code, and published an analysis with a PDF proof of concept. The file carries a crafted embedded font and crashes unpatched iPhones and Macs. It is a crash, not a working attack [S3][S4]. The crash occurs on a path that applications use to build previews of received attachments, so, according to Calif, previewing may be enough to reach the flaw[S3].
That detail is what changes the examiner’s picture. If the preview path alone reaches the code, the owner need not have opened the file. We do not publish the proof of concept or its mechanics; the research post and Apple’s notes are the primary record.
Who needed to act
Apple’s notes place the exposure on versions before iOS 27, so a phone already on iOS 27, which Apple released on 14 September, sits outside the scope Apple described. A phone still on iOS 26 needed 26.7.1. In the two weeks between those releases, a phone on iOS 26 was exposed to a flaw that, by Apple’s account, was already in use [S1][S10]. The gap is a reminder that the iOS version and the date of the examination belong together.
What nobody knows
Three things are unconfirmed. How the real attackers delivered the file is unknown; no public source names a channel. Whether the flaw was used without a tap is unknown. And no one has published indicators from the real attack, such as addresses or file hashes. TechCrunch’s coverage urged owners still on iOS 26 to update[S5]; Apple’s own list is the authority for which versions are fixed. In our review of 2026 advisories we found this one exploited document-renderer flaw on a phone, and no comparable entry for the PDF components of Android. That is a statement about what we found, not a claim about what exists.
Documents over messengers
One documented case of a PDF carrying an attack through a chat app involves WhatsApp. WhatsApp said it stopped a spyware campaign that it attributed to Paragon, a company that has limited its comment, and that reached about 90 users in more than two dozen countries. According to Citizen Lab as relayed by BleepingComputer, attackers added a target to a group and then sent a PDF that triggered infection without a tap. WhatsApp fixed it on its servers, with no update for users and no CVE[S8]. We rely on a press account of Citizen Lab’s findings here and flag the Citizen Lab page for direct checking.
What a phone keeps for a received PDF
This part is our inference, not a documented finding, and it is labeled as such. A PDF received in a chat or mail app normally leaves a message record and an attachment file in the app’s storage. Opening it with a viewer may add a recent-files or preview entry. A failed or crashing render may add a crash log near that time. Any of these can be removed by the owner, by the app, or by the attack itself. No primary report gives the share of malicious attachments that are PDFs, so we publish no such figure.
Our approach
How SectraTEK approaches this
A document that reaches a phone can leave several records: the message that carried it, the attachment itself unless it was deleted, a preview or recent-files entry, and crash logs near the time of opening. If it came by link, browser records may show where it was fetched.
SectraTEK reads iOS and Android file system extractions and device backups. In iOS backups and in iOS and Android full file system extractions it lists the documents and message attachments recorded in the evidence, with their types and the conversation they belong to, and it reads the crash and system logs a device retains, stating the dates they cover. It compares the operating system version with vendor security releases and shows known exploitation as its own field. It does not open or classify the content of a PDF.
The limits are honest ones. An exploited file may be deleted, and the real delivery path here is unknown. A result with no findings means no known indicators were found in the evidence provided.
What this means for examiners
Record the exact iOS build first; for this flaw the line is iOS 26.7.1. Note whether messaging apps preview attachments automatically. Preserve the original message database before any update or restart. A restart can clear temporary preview files, and an update swaps out the very software whose behavior is in question. Where a crash log shows a graphics or thumbnail process failing near a received PDF, treat it as a lead for corroboration, not a verdict. For owners, the advice is Apple’s: update. Where a client reports an unexpected restart or an app closing while a document loaded, write it down with the time; it is cheap to record and hard to reconstruct later.
What the Lab is watching
We are watching four things: any Apple statement on Lockdown Mode and this flaw, any public indicators from the real attack, any claim that iOS 27 is affected, and any further sourced reports of document-based attacks over messengers. Social-media posts claiming PDF-based demonstrations at the Hexacon conference are unconfirmed, and the researchers’ own post names no file type. We will not treat them as fact until a primary source describes them.
Sources
Facts about third parties are attributed to the publisher named in the sentence. Each marker such as [S1] opens its row here.
| Marker | Publisher and title | Published | Accessed | Address |
|---|---|---|---|---|
| [S1] | Apple Support About the security content of iOS and iPadOS 26.7.1 | support.apple.com | ||
| [S2] | CISA Known Exploited Vulnerabilities catalog (data file read 2026-10-21) | www.cisa.gov | ||
| [S3] | Calif The great glyph grift | calif.io | ||
| [S4] | The Hacker News Apple CoreGraphics proof of concept emerges | thehackernews.com | ||
| [S5] | TechCrunch Still running iOS 26? Update your iPhones, iPads and Macs for this urgent security fix | techcrunch.com | ||
| [S6] | Google Project Zero A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution | projectzero.google | ||
| [S7] | Kaspersky (Securelist) Operation Triangulation | securelist.com | ||
| [S8] | BleepingComputer WhatsApp patched zero-day flaw used in Paragon spyware attacks | Address not listed | ||
| [S10] | Security Affairs Apple patches CoreGraphics zero-day linked to sophisticated targeted attacks | securityaffairs.com | ||
| [S9] | Citizen Lab BLASTPASS: NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the Wild | https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ |
The sources were last read on . If a fact here changes, the correction carries its date.