Security research has been released showing that malware can be executed on an iPhone simply by opening a PDF file once. Concerns are growing about the iPhone security system because the attack can be carried out using only a message attachment, without installing a separate app or performing complex steps.

On Oct. 26 (local time), Japanese media outlet Gigazine reported that U.S. security research team Calif demonstrated a one-tap technique to attack an iPhone using a malicious PDF file. Calif disclosed the technology at the Hexacon security conference held in Paris, France, on Oct. 16.

In the demonstration video, when a PDF delivered via the encrypted messenger Signal was opened, the Calif logo appeared on the iPhone screen and moved. A similar attack was reproduced on Apple’s default messaging service iMessage. The method lures users into opening a file and is distinct from a zero-click attack that runs automatically without any separate action.

Calif has not yet disclosed the specific attack technique. It introduced the CoreGraphics vulnerability CVE-2026-86950 as a case of security problems that occur during PDF processing.

The vulnerability allows data to be written outside memory boundaries when processing special fonts included in a PDF. Meta’s security team reported it to Apple, and Apple fixed it in iOS 26.7.1 released on Sept. 28. It has not been confirmed whether the vulnerability was actually used in the one-tap attack.

Calif said it reported about 100 security flaws to Apple this year and also reported most of the vulnerabilities used in the attack.

The research team claimed it also succeeded in jailbreaking the iPhone to lift security restrictions in the latest operating system, iOS 27.0.1. It released footage showing the jailbreak state remaining even after the device was rebooted.

It also carried out a jailbreak demonstration on the recently released iPhone Duo. It does not plan to distribute a jailbreak tool for general users.

Security experts advise that it is important not to open PDF files from unclear sources and to keep the operating system up to date. They said further disclosure and verification are needed to determine whether the new attack technique has been patched.