CVE-2026-86950

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-86950 8.8

Apple · Multiple Products · Added 2026-09-29 · Published 2026-09-28

3-Day Required KEV Active Exploitation

Details

VulnerabilityApple Multiple Products Out-of-Bounds Write Vulnerability

VendorApple

ProductMultiple Products

Date added2026-09-29

Due date2026-10-02

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-787

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Descriptions

KEV: Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.

NVD: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-09-29 14:38 UTC

Wall time0.6s

Searches1

Component defaultyes

Sources https://support.apple.com/en-us/149226
https://support.apple.com/en-us/149228
https://support.apple.com/en-us/149229
http://seclists.org/fulldisclosure/2026/Sep/89
http://seclists.org/fulldisclosure/2026/Sep/90
http://seclists.org/fulldisclosure/2026/Sep/91
https://thehackernews.com/2026/09/apple-patches-coregraphics-flaw.html
https://www.securityweek.com/apple-patches-meta-reported-zero-day-linked-to-extremely-sophisticated-attack/
https://nvd.nist.gov/vuln/detail/CVE-2026-86950

Hunting hypothesis agent

Hunt EDR and mail-gateway logs for crafted image or PDF files hitting CoreGraphics parsers on unpatched Apple devices — flag file-open and crash telemetry on iOS before 27 or macOS 15.8.x showing the out-of-bounds write.

Research details

ComponentCoreGraphics framework bounds-checked file parsing/rendering path (2D graphics and PDF rendering code invoked when processing files)

PreconditionsNo authentication required; the attacker must deliver a maliciously crafted file that the CoreGraphics framework parses, and a user must open or preview it (CVSS UI:R). Affected: iOS/iPadOS before 27 (fixed in 26.7.1), macOS Tahoe before 26.7.1, macOS Sequoia before 15.8.1. Apple reports possible in-the-wild exploitation on iOS before iOS 27. agent

Deliverycrafted file (image/PDF content rendered by CoreGraphics) delivered via web pages, email attachments, or messaging apps

Public PoCno

Advisoryhttps://support.apple.com/en-us/149226

Exploit notesCVSS attack complexity: LOW (AV:N/AC:L/PR:N/UI:R, base 8.8) | No functional public PoC found: the only GitHub repository matching the CVE ID (DeAurity/CVE-2026-86950-POC) contains just a README that advertises selling the exploit via an external link, with no code published | Apple warns the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS before iOS 27

SummaryOut-of-bounds write (CWE-787) in Apple's CoreGraphics framework that may lead to arbitrary code execution when a maliciously crafted file is processed, reported by Meta Product Security. Apple released fixes on September 28, 2026 in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. Apple warns the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS before iOS 27. No functional public PoC is available; the sole GitHub repository advertising one is a README-only sales listing with no exploit code.

Tia coverage

First reported2026-09-28

First exploit report2026-09-28

Exploit report → KEV1 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

apple-patches-coregraphics-out-of-bounds-write-cve-2026-86950

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.