Skip to content
Sign in
CVE-2026-869508.8High

CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability

Apple · iOS and iPadOS

Vendor fix available · Affected: Apple iOS and iPadOS · Exploitation: in CISA KEV since 29 Sep

ExploitationIn CISA KEV

  1. In CISA KEVCISA KEV catalogue29 Sep
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public6 public GitHub repositories (unverified), listed by PoC-in-GitHub1 Oct
  5. Not established: not seen
26.2%probability of exploitation in the next 30 days
98th percentile
050100

Higher than 98% of scored CVEs

8.8HighCVSS
LowHigh

Federal deadline

CISA KEV · added 29 Sep · catalogue entry

Passed 30 days ago

DescriptionNVD

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

What changed

  1. PoC-in-GitHub lists 7 public GitHub repositories (unverified) PoC-in-GitHub
  2. CISA added it to the KEV catalogue CISA

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Coverage16 articles · 9 outlets

One row per outlet, in order of first report. First in our coverage: SANS ISC, 28 Sep.

Full timeline
Quiet for 2 weekslast report 29 Oct16 articles9 outlets
28 Sep · SANS ISC first23 Oct31 OctNow
  • Mon 28 Sep, 23:30 UTC. SANS ISC, first report. Apple Patches Exploited Zero Day Targeting Older iOS Versions. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 02:29 UTC. SecurityOnline, its first report on the story. Apple Patches Actively Exploited Zero Day Allowing Code Execution. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 06:30 UTC. SecurityWeek, its first report on the story. Apple Patches iOS Flaw Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 10:58 UTC. Malwarebytes, its first report on the story. Apple Fixes Exploited iPhone Flaw in Targeted Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 14:25 UTC. Security Affairs, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iOS Attacks. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 15:02 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited Apple CoreGraphics Flaw. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 22:00 UTC. Dark Reading, its first report on the story. Apple Patches Actively Exploited CoreGraphics Zero Day in Targeted Attacks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. CISA Flags Exploited Apple Graphics Flaw Affecting iPhones and Macs. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 09:01 UTC. Infosecurity, its first report on the story. Apple Patches CoreGraphics Zero Day Exploited in Targeted iPhone Attacks. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 07:31 UTC. The Hacker News, its first report on the story. Apple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. Security Affairs. Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 04:06 UTC. SecurityOnline. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 00:30 UTC. SANS ISC. Apple fixes 304 flaws, including one exploited in targeted attacks. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. Apple backports exploited CoreGraphics flaw fix to older iPhones. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 13:40 UTC. SecurityWeek. Apple patches 286 flaws and backports fix for exploited bug. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 12:00 UTC. Malwarebytes. Apple backports fix for exploited flaw to older iPhones and iPads. Cites a CVE in CISA KEV.
All coveragerunning totalAdded to CISA KEV · 29 Sep16SANS ISC2SecurityOnl…3SecurityWeek2Malwarebytes2Security Af…3CISA1Dark Reading1Infosecurity1The Hacker…129 Sep15 Oct31 OctNow
  • First report
  • Article
  • Official notice
  • Running total

Added to CISA KEV

Show as table
16 articles about CVE-2026-86950 from 9 outlets
Published (UTC)OutletHeadline
28 Sep 23:30SANS ISCApple Patches Exploited Zero Day Targeting Older iOS Versions
29 Sep 02:29SecurityOnlineApple Patches Actively Exploited Zero Day Allowing Code Execution
29 Sep 06:30SecurityWeekApple Patches iOS Flaw Exploited in Targeted Attacks
29 Sep 10:58MalwarebytesApple Fixes Exploited iPhone Flaw in Targeted Attacks
29 Sep 14:25Security AffairsApple Patches CoreGraphics Zero Day Exploited in Targeted iOS Attacks
29 Sep 15:02CISACISA Warns of Actively Exploited Apple CoreGraphics Flaw
29 Sep 22:00Dark ReadingApple Patches Actively Exploited CoreGraphics Zero Day in Targeted Attacks
30 Sep 08:25Security AffairsCISA Flags Exploited Apple Graphics Flaw Affecting iPhones and Macs
30 Sep 09:01InfosecurityApple Patches CoreGraphics Zero Day Exploited in Targeted iPhone Attacks
1 Oct 07:31The Hacker NewsApple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation
1 Oct 12:31Security AffairsApple Patches CoreGraphics Zero Day Exploited in Targeted Attacks
5 Oct 04:06SecurityOnlineSeven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk
27 Oct 00:30SANS ISCApple fixes 304 flaws, including one exploited in targeted attacks
27 Oct 04:30SecurityOnlineApple backports exploited CoreGraphics flaw fix to older iPhones
27 Oct 13:40SecurityWeekApple patches 286 flaws and backports fix for exploited bug
29 Oct 12:00MalwarebytesApple backports fix for exploited flaw to older iPhones and iPads
  1. Apple backports fix for exploited flaw to older iPhones and iPads
    Malwarebytes
  2. Apple patches 286 flaws and backports fix for exploited bug
    SecurityWeek
  3. Apple backports exploited CoreGraphics flaw fix to older iPhones
    SecurityOnline
  4. Apple fixes 304 flaws, including one exploited in targeted attacks
    SANS ISC
  5. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk
    SecurityOnline · mentions it in passing
  6. Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks
    Security Affairs
  7. Apple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation
    The Hacker News
  8. Apple Patches CoreGraphics Zero Day Exploited in Targeted iPhone Attacks
    Infosecurity
Show 8 more

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in