CVE-2026-86950
published 2026-09-28CVE-2026-86950: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS…
PriorityP188high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2026-10-13
Exploited in the wild
EPSS
1.24%
68.9th percentile
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_and_ipados | < 26.7.1 | 26.7.1 |
| apple | ipados | < 26.7.1 | 26.7.1 |
| apple | iphone_os | < 26.7.1 | 26.7.1 |
| apple | macos | < 26.7.1 | 26.7.1 |
| apple | macos | < 15.8.1 | 15.8.1 |
| apple | macos | >= 26.0 < 26.7.1 | 26.7.1 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
cisa8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apple iOS/iPadOS/macOS prior 26.7.1/15.8.1 out-of-bounds write
vuldb·2026-09-28·CVSS 8.8
CVE-2026-86950 [HIGH] Apple iOS/iPadOS/macOS prior 26.7.1/15.8.1 out-of-bounds write
A vulnerability was found in Apple iOS, iPadOS and macOS. It has been classified as critical. Affected is an unknown function. This manipulation causes out-of-bounds write.
This vulnerability is tracked as CVE-2026-86950. The attack is restricted to local execution. No exploit exists.
Upgrading the affected component is recommended.
GHSA
An out-of-bounds write issue was addressed with improved bounds checking.
ghsa_unreviewed·2026-09-28
CVE-2026-86950 [HIGH] CWE-787 An out-of-bounds write issue was addressed with improved bounds checking.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
VulnCheck
Apple ipados Out-of-bounds Write
vulncheck·2026·CVSS 8.8
CVE-2026-86950 [HIGH] Apple ipados Out-of-bounds Write
Apple ipados Out-of-bounds Write
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
Affected: Apple ipados
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://support.apple.com/en-us/149226; https://support.apple.com/en-us/149228; https://support.apple.com/en-us/149229
CISA
Apple Multiple Products Out-of-Bounds Write Vulnerability
cisa·2026-09-29·CVSS 8.8
CVE-2026-86950 [HIGH] CWE-787 Apple Multiple Products Out-of-Bounds Write Vulnerability
Vulnerability: Apple Multiple Products Out-of-Bounds Write Vulnerability
Affected: Apple Multiple Products
Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: https://support.apple.com/en-us/149226 ; htt
No detection rules found.
No public exploits indexed.
Checkpoint
5th October – Threat Intelligence Report
blogs_checkpoint·2026-10-05
CVE-2026-88771 5th October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 5th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 5th October, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
Arizona’s state court system has suffered a phishing-led cyberattack after an employee clicked a malicious link. Attackers copied backup files containing protective-order records and more than 150,000 Foster Care Review Board reports dating back to 2010, exposing personal and case-related information belonging to current and former participan
Hackernews
Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path
blogs_hackernews·2026-10-01·CVSS 8.8
CVE-2026-86950 [HIGH] Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path
Security researchers have published the first public proof-of-concept for CVE-2026-86950 , an Apple CoreGraphics flaw Apple says may have been used in attacks against specific targeted individuals.
The trigger is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs. The code causes a crash, not an execution error. Turning the memory corruption into a working exploit is separate work the analysis does not demonstrate.
Apple patched the flaw on September 28 , crediting Meta Product Security with the discovery a
Hackernews
Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks
blogs_hackernews·2026-09-29·CVSS 7.8
CVE-2026-86950 [HIGH] Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks
Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks.
The vulnerability, tracked as CVE-2026-86950 , refers to an out-of-bounds write impacting the CoreGraphics component that could lead to arbitrary code execution when processing a maliciously crafted file.
The iPhone maker said the issue was addressed with improved bounds checking. It credited Meta Product Security with discovering and reporting the issue.
"Apple is aware of a report that thi
Sans Isc
Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th)
blogs_sans_isc·2026-09-28·CVSS 8.8
CVE-2026-86950 [HIGH] Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th)
Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950)
Published: 2026-09-28. Last Updated: 2026-09-28 22:35:35 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
Apple today released patches for all of its operating systems. However, only patches for older branches include a security fix. The vulnerability being addressed in iOS 26, macOS 26 and macOS 15 is already being exploited. iOS and macOS 27 are not affected. Today's update for the current "27" branch does not address security issues, but fixes some functional issues that got caught after the release two weeks ago. A 27.1 version was also expected to support the new foldable iPhone and will likely include specific features geared to the soon to be available device.
Apple credits Meta Product Security with reporting
https://support.apple.com/en-us/149226https://support.apple.com/en-us/149228https://support.apple.com/en-us/149229http://seclists.org/fulldisclosure/2026/Sep/89http://seclists.org/fulldisclosure/2026/Sep/90http://seclists.org/fulldisclosure/2026/Sep/91https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86950
2026-09-28
Published
2026-09-29
Added to CISA KEV
Exploited in the wild