CVE-2026-86950: Auditing the CoreGraphics Image and Font Decoding Path After an In-the-Wild Zero-Day

Apple's out-of-band fix for CVE-2026-86950, a CoreGraphics image and font decoding zero-day exploited in extremely sophisticated targeted spyware-style attacks, exposes why media parsing remains a durable remote attack surface and why older devices frequently sit in a patch gap.