CVE-2026-86950, Apple iOS, iPadOS and macOS CoreGraphics: out-of-bounds write exploited in an extremely sophisticated attack on targeted iOS users, CISA KEV-listed (CVSS 8.8)
Apple's exploited CoreGraphics zero-day is now fixed for iPhone XS, XS Max, XR and iPad 7th generation (iOS 18.7.11)
Defender actions
- Push iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 through device management now, and iOS and iPadOS 18.7.11 to every iPhone XS, XS Max, XR and iPad 7th generation, starting with the devices of staff who could be individually targeted; Apple describes the exploitation only on iOS before iOS 27.
Analysis
CVE-2026-86950 is an out-of-bounds write in CoreGraphics, the graphics component shared by iOS, iPadOS and macOS, and processing a maliciously crafted file can lead to arbitrary code execution (Apple, 2026-09-28). Apple states that it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27" (Apple, 2026-09-28). The fix, "improved bounds checking", ships in iOS and iPadOS 26.7.1 (Apple, 2026-09-28), in iOS and iPadOS 18.7.11 for iPhone XS, XS Max, XR and iPad 7th generation (Apple, 2026-10-26), macOS Tahoe 26.7.1 (Apple, 2026-09-28) and macOS Sequoia 15.8.1 (Apple, 2026-09-28); Meta Product Security is credited with the report. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-09-29 (CISA, 2026-09-29). ENISA's vulnerability database scores it CVSS 3.1 8.8, network vector with user interaction required (ENISA EUVD, 2026-09-29). The macOS advisories repeat Apple's iOS-scoped exploitation sentence, so Apple does not claim exploitation on macOS.
Nothing about the attack itself is public: Apple gave no details on how many people were targeted, whether any attempt succeeded, or when exploitation began (The Hacker News, 2026-09-29), and no delivery mechanism is stated. SecurityWeek reads the component's role in 2D graphics and PDF rendering as meaning a file could arrive through web pages, email attachments or messaging apps, where automatic previews could allow zero-click exploitation; that is SecurityWeek's inference, and it also notes Meta would not say whether WhatsApp was involved (SecurityWeek, 2026-09-29). It also says iOS 27 and macOS Golden Gate 27 do not appear to be affected. No indicators or behavioural detections have been published by Apple, Meta or CISA, so version compliance is the only measurable lever: device-management inventory of iPhones and iPads below iOS or iPadOS 26.7.1 (below 18.7.11 on iPhone XS, XS Max, XR and iPad 7th generation), and of Macs on Tahoe or Sequoia below the fixed builds.
Cited evidence
Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later
An out-of-bounds write issue was addressed with improved bounds checking.
Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
the company offered no details on how many individuals were targeted, if any of those attempts were successful, or when the first instance of CVE-2026-86950 exploitation occurred
The trigger is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs.
The published analysis does not describe or test a WhatsApp delivery path.
Updates3
Researchers at Calif published a public proof of concept for CVE-2026-86950 on 2026-09-30, built from a public binary comparison of iOS 26.7 and 26.7.1: a PDF with a crafted TrueType font that triggers a controlled out-of-bounds write in CoreGraphics and crashes unpatched iPhones and Macs, with generation scripts and a sample PDF in a public GitHub repository (The Hacker News, 2026-10-01). Calif demonstrates a crash and a controlled write to two adjacent 16-bit values, not code execution, did not obtain the in-the-wild sample and cannot say how the attacker completed the chain (The Hacker News, 2026-10-01). The harness reaches the flaw through the ImageIO thumbnail path an app uses to preview a received attachment (The Hacker News, 2026-10-01). Calif pointed to new font-checking code in WhatsApp's attachment scanner as circumstantial evidence of a possible delivery path; the published analysis does not describe or test that path, a WhatsApp sentence in the first version was removed after publication, and WhatsApp has published no advisory linking the flaw to its products (The Hacker News, 2026-10-01).
CISA's catalog record for CVE-2026-86950 does not set the forensic-triage flag that it sets for some other recent listings; the 2026-09-29 listing carries only the catalog's standard required action (CISA, 2026-09-29). The analysis had said CISA attached its forensic-triage requirements to the listing.
Apple's security content for iOS 18.7.11 and iPadOS 18.7.11, released 2026-10-26, lists CVE-2026-86950 as fixed for iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation and repeats Apple's statement that it is aware of a report of exploitation in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27 (Apple, 2026-10-26). The notes for iOS and iPadOS 26.7.1 of 2026-09-28 list the fix for iPhone 11 and later and for iPad models from the iPad 8th generation, and the CISA catalog record for the flaw names no other Apple document, so in the documents these sources name the fix reaches those four device families four weeks after the others (Apple, 2026-09-28; CISA, 2026-09-29). SANS Internet Storm Center says this round delivers the corresponding iOS 18 patches for a flaw patched a month earlier and that no new vulnerability is marked as already exploited (SANS ISC, 2026-10-27).
Sources10
Revision history
- Published 2026-09-30T0404Z-intel
- Update 2026-10-02T0404Z-intel
Calif published a public proof of concept on 2026-09-30 that crashes unpatched iPhones and Macs through a PDF with a crafted font, built from a public comparison of the 26.7 and 26.7.1 builds; it shows a controlled out-of-bounds write but not code execution, and the WhatsApp delivery path Calif speculated about is not described or tested.
Changed: summary tags cves sources evidence body
- Correction 2026-10-11T1307Z-audit
CISA's KEV record for CVE-2026-86950 does not set the forensic-triage flag, so the statement that CISA attached its forensic-triage requirements to the listing is withdrawn. The CVE's EPSS value is corrected from 0.81 (a percentage figure read as a probability) to FIRST's 0.01242.
Changed: cves body
- Update 2026-10-27T0256Z-intel
Apple's iOS and iPadOS 18.7.11 of 2026-10-26 deliver the CVE-2026-86950 fix to iPhone XS, XS Max, XR and iPad 7th generation, four weeks after the 26.7.1 releases that did not list those devices; the flaw remains exploited against targeted individuals and KEV-listed.
Changed: actions body cves evidence headline sources summary
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.