High severity · published Sep 28, 2026
CVE-2026-86950
Apple Multiple Products Out-of-Bounds Write Vulnerability
In wildKEV
8.8
CVSS
26.2%
EPSS
Yes
On KEV
Description
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)26.2% · higher than 98% of CVEs
Exploited in the wildYes
CISA KEVListed Sep 29, 2026
Federal remediation dueOct 13, 2026
Ransomware campaign useNot known
Affected products
Which versions
MA
macOS · Apple
before 15.8.1; before 26.7.1 · source: vendor, NVD
IO
iOS · Apple
before 18.7.11; 26.0 before 26.7.1 · source: NVD
IA
iOS and iPadOS · Apple
before 18.7.11; before 26.7.1 · source: vendor
MP
Multiple Products · Apple
All versions, or not specified · source: KEV
In the news
VulnerabilityHigh
Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices.
The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file.
Patches for the flaw were released last month by Apple in
Oct 27, 2026·The Hacker News
VulnerabilityCritical
Public PoC Released for Apple CoreGraphics Zero-Day CVE-2026-86950
Apple patched a CoreGraphics zero-day that may have been exploited in targeted attacks. A public PoC for the flaw is now available. Apple patched a zero-day vulnerability, tracked as CVE-2026-86950, in CoreGraphics that attackers may have exploited to target specific individuals. The flaw is an out-of-bounds write that can lead to arbitrary code execution when […]
Oct 1, 2026·Security Affairs
VulnerabilityHigh
Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path
Security researchers have published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw Apple says may have been used in attacks against specific targeted individuals.
The trigger is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs. The code causes a crash, not an execution error. Turning the memory corruption into a working
Oct 1, 2026·The Hacker News
VulnerabilityHigh
U.S. CISA adds Apple Multiple Products flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple Multiple Products flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Apple Multiple Products flaw, tracked as CVE-2026-86950 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. This week, Apple has released security updates for iOS, iPadOS […]
Sep 30, 2026·Security Affairs
VulnerabilityCritical
Apple Zero-Day Vulnerability Weaponized in Targeted Attacks
Attackers are exploiting CVE-2026-86950, an out-of-bounds write flaw, in an extremely sophisticated fashion, according to Apple.
Sep 29, 2026·Dark Reading
VulnerabilityCritical
Apple Patches CoreGraphics Zero-Day Linked to Sophisticated Targeted Attacks
Apple patched zero-day CVE-2026-86950 in CoreGraphics, exploited in sophisticated targeted attacks against specific iOS users. Apple has released security updates for iOS, iPadOS and macOS to fix a zero-day vulnerability, tracked as CVE-2026-86950, in CoreGraphics that may have been exploited in attacks against specific individuals. The flaw is an out-of-bounds write that can lead to […]
Sep 29, 2026·Security Affairs
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86950
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86950
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
support.apple.com
https://support.apple.com/en-us/149225
support.apple.com
https://support.apple.com/en-us/149226
support.apple.com
https://support.apple.com/en-us/149228
support.apple.com
https://support.apple.com/en-us/149229
More from macOS
10.0
CVE-2025-43300
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2025-24085
Apple Multiple Products Use-After-Free Vulnerability
9.8
CVE-2026-65400
Apple macOS Improper Authentication Vulnerability
9.8
CVE-2025-31200
Apple Multiple Products Memory Corruption Vulnerability