CVE-2026-86950, Apple iOS, iPadOS and macOS CoreGraphics: out-of-bounds write exploited in an extremely sophisticated attack on targeted iOS users, CISA KEV-listed (CVSS 8.8)
Apple patches a CoreGraphics zero-day exploited against targeted iPhone users; a crafted file can lead to code execution
Defender actions
- Push iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 through device management now, starting with the devices of staff who could be individually targeted; Apple describes the exploitation only on iOS before iOS 27.
Analysis
CVE-2026-86950 is an out-of-bounds write in CoreGraphics, the graphics component shared by iOS, iPadOS and macOS, and processing a maliciously crafted file can lead to arbitrary code execution (Apple, 2026-09-28). Apple states that it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27" (Apple, 2026-09-28). The fix, "improved bounds checking", ships in iOS and iPadOS 26.7.1 (Apple, 2026-09-28), macOS Tahoe 26.7.1 (Apple, 2026-09-28) and macOS Sequoia 15.8.1 (Apple, 2026-09-28); Meta Product Security is credited with the report. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-09-29 and attached its forensic-triage requirements to the listing (CISA, 2026-09-29). ENISA's vulnerability database scores it CVSS 3.1 8.8, network vector with user interaction required (ENISA EUVD, 2026-09-29). The macOS advisories repeat Apple's iOS-scoped exploitation sentence, so Apple does not claim exploitation on macOS.
Nothing about the attack itself is public: Apple gave no details on how many people were targeted, whether any attempt succeeded, or when exploitation began (The Hacker News, 2026-09-29), and no delivery mechanism is stated. SecurityWeek reads the component's role in 2D graphics and PDF rendering as meaning a file could arrive through web pages, email attachments or messaging apps, where automatic previews could allow zero-click exploitation; that is SecurityWeek's inference, and it also notes Meta would not say whether WhatsApp was involved (SecurityWeek, 2026-09-29). It also says iOS 27 and macOS Golden Gate 27 do not appear to be affected. No indicators or behavioural detections have been published by Apple, Meta or CISA, so version compliance is the only measurable lever: device-management inventory of iPhones and iPads still on the iOS 26 branch below 26.7.1, and of Macs on Tahoe or Sequoia below the fixed builds.
Cited evidence
Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
An out-of-bounds write issue was addressed with improved bounds checking.
Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
the company offered no details on how many individuals were targeted, if any of those attempts were successful, or when the first instance of CVE-2026-86950 exploitation occurred
Sources7
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.