Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-86950: iOS, macOS, iPadOS CoreGraphics could let attackers run code
CVE-2026-86950 · published 20 days ago · actively exploited
Summary
Apple's iPhone, iPad, and Mac operating systems have a flaw in the CoreGraphics component that could allow a malicious program to write outside its intended memory area and take control of the device. This could let an attacker run unwanted software on the device, potentially stealing data or disrupting operations. Install the latest system updates from Apple as soon as they are available to fix the issue.
What to do
- Update apple ios and ipados to version 26.7.1 or later.
- Update apple ipados to version 26.7.1 or later.
- Update apple iphone_os to version 26.7.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| apple | ios and ipados | < 26.7.1 |
| apple | macos |
< 15.8.1 >= 26.0, < 26.7.1 |
| apple | multiple products | All versions |
| apple | ipados |
< 26.7.1 cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* |
| apple | iphone_os |
< 26.7.1 cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
Original advisory text
Apple Multiple Products Out-of-Bounds Write Vulnerability
Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
References
- http://seclists.org/fulldisclosure/2026/Sep/90 Mailing List Third Party Advisory
- http://seclists.org/fulldisclosure/2026/Sep/91 Mailing List Third Party Advisory
- https://support.apple.com/en-us/149226 Release Notes Vendor Advisory
- https://support.apple.com/en-us/149228 Release Notes Vendor Advisory
- https://support.apple.com/en-us/149229 Release Notes Vendor Advisory
- http://seclists.org/fulldisclosure/2026/Sep/89 Mailing List Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-... US Government Resource
Internet-facing
3 days
and check for signs of compromise
Internal
14 days
- Known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.8
High
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
1%
chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published28 Sep 2026
Updated19 Oct 2026
First seen28 Sep 2026
Track software like this
Free during beta