CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Apple iOS/iPadOS/macOS CoreGraphics out-of-bounds write exploited in a targeted attack on iOS before iOS 27, fixed in 26.7.1 / Tahoe 26.7.1 / Sequoia 15.8.1, CISA KEV 2026-09-29

cve · CVE-2026-86950

Coverage
1
first 2026-09-30 → last 2026-11-01
Latest activity
2026-10-27
Apple's exploited CoreGraphics zero-day is now fixed for iPhone XS, XS Max, XR and iPad 7th generation (iOS…
Peak priority
high
1 high
Targets
public-sector
sectors: public-sector
Sources cited
10
6 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-86950, newest first. Check the date before acting on an older one.

  • Push iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 through device management now, and iOS and iPadOS 18.7.11 to every iPhone XS, XS Max, XR and iPad 7th generation, starting with the devices of staff who could be individually targeted; Apple describes the exploitation only on iOS before iOS 27.
    2026-09-30CVE-2026-86950

Defender insights

What each entry about CVE-2026-86950 tells a defender to do, newest first.

Story timeline

  1. 2026-09-30CVE-2026-86950, Apple iOS, iPadOS and macOS CoreGraphics: out-of-bounds write exploited in an extremely sophisticated attack on targeted iOS users, CISA KEV-listed (CVSS 8.8)
    trending-vulnerabilitiesApple's exploited CoreGraphics zero-day is now fixed for iPhone XS, XS Max, XR and iPad 7th generation (iOS 18.7.11)

Hunting pivots

Affected products
Apple iOSApple iPadOSApple macOS
Tags
actively-exploitedcisa-kevmobilepatch-availablepoc-publicrcevulnerabilitieszero-day
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • ExecutionExploitation for Client Execution

Execution TA0002

T1203Exploitation for Client Execution×1

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

Evidence: 2026-09-30/cve-2026-86950-apple-coregraphics-zero-day-kev · ATT&CK page ↗

Entries about Apple iOS/iPadOS/macOS CoreGraphics out-of-bounds write exploited in a targeted attack on iOS before iOS 27, fixed in 26.7.1 / Tahoe 26.7.1 / Sequoia 15.8.1, CISA KEV 2026-09-29 (1)

2026-09-30 · view entry permalink →

HIGHCVE-2026-86950exploitedupdatedNATOA2

CVE-2026-86950, Apple iOS, iPadOS and macOS CoreGraphics: out-of-bounds write exploited in an extremely sophisticated attack on targeted iOS users, CISA KEV-listed (CVSS 8.8)

CVE-2026-86950 is an out-of-bounds write in CoreGraphics, the graphics component shared by iOS, iPadOS and macOS, and processing a maliciously crafted file can lead to arbitrary code execution (Apple, 2026-09-28). Apple states that it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27" (Apple, 2026-09-28). The fix, "improved bounds checking", ships in iOS and iPadOS 26.7.1 (Apple, 2026-09-28), in iOS and iPadOS 18.7.11 for iPhone XS, XS Max, XR and iPad 7th generation (Apple, 2026-10-26), macOS Tahoe 26.7.1 (Apple, 2026-09-28) and macOS Sequoia 15.8.1 (Apple, 2026-09-28); Meta Product Security is credited with the report. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-09-29 (CISA, 2026-09-29). ENISA's vulnerability database scores it CVSS 3.1 8.8, network vector with user interaction required (ENISA EUVD, 2026-09-29). The macOS advisories repeat Apple's iOS-scoped exploitation sentence, so Apple does not claim exploitation on macOS.

Nothing about the attack itself is public: Apple gave no details on how many people were targeted, whether any attempt succeeded, or when exploitation began (The Hacker News, 2026-09-29), and no delivery mechanism is stated. SecurityWeek reads the component's role in 2D graphics and PDF rendering as meaning a file could arrive through web pages, email attachments or messaging apps, where automatic previews could allow zero-click exploitation; that is SecurityWeek's inference, and it also notes Meta would not say whether WhatsApp was involved (SecurityWeek, 2026-09-29). It also says iOS 27 and macOS Golden Gate 27 do not appear to be affected. No indicators or behavioural detections have been published by Apple, Meta or CISA, so version compliance is the only measurable lever: device-management inventory of iPhones and iPads below iOS or iPadOS 26.7.1 (below 18.7.11 on iPhone XS, XS Max, XR and iPad 7th generation), and of Macs on Tahoe or Sequoia below the fixed builds.

Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

Apple Security

Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation

Apple Security (iOS 18.7.11 and iPadOS 18.7.11) 2026-10-26

Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later

Apple Security (iOS 26.7.1 and iPadOS 26.7.1) 2026-09-28

An out-of-bounds write issue was addressed with improved bounds checking.

Apple Security

Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.

CISA Known Exploited Vulnerabilities Catalog 2026-09-29

the company offered no details on how many individuals were targeted, if any of those attempts were successful, or when the first instance of CVE-2026-86950 exploitation occurred

The trigger is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs.

The published analysis does not describe or test a WhatsApp delivery path.

The Hacker News 2026-09-29
Updaterun 2026-10-02T0404Z-intelsummarytagscvessourcesevidencebody

Researchers at Calif published a public proof of concept for CVE-2026-86950 on 2026-09-30, built from a public binary comparison of iOS 26.7 and 26.7.1: a PDF with a crafted TrueType font that triggers a controlled out-of-bounds write in CoreGraphics and crashes unpatched iPhones and Macs, with generation scripts and a sample PDF in a public GitHub repository (The Hacker News, 2026-10-01). Calif demonstrates a crash and a controlled write to two adjacent 16-bit values, not code execution, did not obtain the in-the-wild sample and cannot say how the attacker completed the chain (The Hacker News, 2026-10-01). The harness reaches the flaw through the ImageIO thumbnail path an app uses to preview a received attachment (The Hacker News, 2026-10-01). Calif pointed to new font-checking code in WhatsApp's attachment scanner as circumstantial evidence of a possible delivery path; the published analysis does not describe or test that path, a WhatsApp sentence in the first version was removed after publication, and WhatsApp has published no advisory linking the flaw to its products (The Hacker News, 2026-10-01).

Correctionrun 2026-10-11T1307Z-auditcvesbody

CISA's catalog record for CVE-2026-86950 does not set the forensic-triage flag that it sets for some other recent listings; the 2026-09-29 listing carries only the catalog's standard required action (CISA, 2026-09-29). The analysis had said CISA attached its forensic-triage requirements to the listing.

Updaterun 2026-10-27T0256Z-intelactionsbodycvesevidenceheadlinesourcessummary

Apple's security content for iOS 18.7.11 and iPadOS 18.7.11, released 2026-10-26, lists CVE-2026-86950 as fixed for iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation and repeats Apple's statement that it is aware of a report of exploitation in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27 (Apple, 2026-10-26). The notes for iOS and iPadOS 26.7.1 of 2026-09-28 list the fix for iPhone 11 and later and for iPad models from the iPad 8th generation, and the CISA catalog record for the flaw names no other Apple document, so in the documents these sources name the fix reaches those four device families four weeks after the others (Apple, 2026-09-28; CISA, 2026-09-29). SANS Internet Storm Center says this round delivers the corresponding iOS 18 patches for a flaw patched a month earlier and that no new vulnerability is marked as already exploited (SANS ISC, 2026-10-27).

vulnerability30 Sep 04:40Zmulti-sourceOpen finding →
Sources: Apple Security (iOS 26.7.1 and iPadOS 26.7.1) · Apple Security (iOS 18.7.11 and iPadOS 18.7.11) · SANS Internet Storm Center (Apple October 2026 updates) · Apple Security (macOS Tahoe 26.7.1) · Apple Security (macOS Sequoia 15.8.1) · CISA Known Exploited Vulnerabilities Catalog · ENISA EU Vulnerability Database · SecurityWeek · The Hacker News

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • support.apple.com4 (40%)
  • thehackernews.com2 (20%)
  • cisa.gov1 (10%)
  • euvd.enisa.europa.eu1 (10%)
  • isc.sans.edu1 (10%)
  • securityweek.com1 (10%)

External references

NVD · cve.org · CISA KEV

All cited sources (10)