Reported by 26 outlets
Apple patches CoreGraphics out-of-bounds write CVE-2026-86950
Why this score
- Breadth
- 2.00 / 2.0 · 26 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.29 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.40 / 1.5 · reddit signal
- Score
- 0.4 / 10 = base × recency + community
Desk analysis
Apple patched an out-of-bounds write in CoreGraphics tracked as CVE-2026-86950, alongside additional CVEs including CVE-2025-43300, CVE-2025-55177, and CVE-2026-20700. The event references standard Apple security updates without specific exploitation confirmation. The scope is Apple devices running affected operating system versions.
As with most Apple security updates, the recommendation is standard: update promptly on all managed Apple endpoints. Without confirmed in-the-wild exploitation, urgency is moderate but still important given the out-of-bounds write nature.
Timeline
-
original reporting
🤖 Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics affecting older iOS/iPadOS/macOS versions. Processing a maliciously c
thehackernews.com · 15d ago · September 28th, 2026
🤖 Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics affecting older iOS/iPadOS/macOS versions. Processing a maliciously c
via Mastodon https://thehackernews.com/2026/09/apple-patches-coregraphics-flaw.html
-
update from support.apple.com
About the security content of iOS 26.7.1 and iPadOS 26.7.1
support.apple.com · 16d ago · September 28th, 2026
Apple released security updates on September 28, 2026, documenting CVE-2026-86950 as an out-of-bounds write in CoreGraphics that allows arbitrary code execution when processing a maliciously crafted file. The advisory credits Meta Product Security, confirms the fix ships in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, and states Apple is aware of reports of exploitation in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
-
update from 9to5mac.com
iOS 26.7.1 available now for iPhone with security fixes
9to5mac.com · 15d ago · September 28th, 2026
9to5Mac published coverage on September 28, 2026 at 10:29 am PT (17:29 UTC) confirming iOS 26.7.1 includes a single security fix for CVE-2026-86950. The post quotes Apple's advisory describing the out-of-bounds write, the malicious-file exploitation path, and the affected device list, and advises users still on iOS 26 to install the update.
-
update from thehackernews.com
Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks
thehackernews.com · 15d ago · September 28th, 2026
The article notes Meta Product Security discovered the bug, that Apple said it may have been exploited in targeted iOS attacks before iOS 27, and lists the affected versions and devices covered by the emergency patches.
-
update from malware.news
Apple Emergency Patch for iOS 26/macOS26/macOS15 (CVE-2026-86950), (Mon, Sep 28th)
malware.news · 15d ago · September 28th, 2026
Apple today released patches for all of its operating systems. However, only patches for older branches include a security fix. The vulnerability being addressed in iOS 26, macOS 26 and macOS 15 is already being exploited. iOS and macOS 27 are not affected. Today’s update for the current “27” branch does not address security issues, but fixes some functional issues that got caught after the release two weeks ago. A 27.1 version was also expected to support the new foldable iPhone and will likely include specific features geared to the soon to be available device. Article Link: Apple Emergency Patch for iOS 26/macOS26/macOS15 (CVE-2026-86950)
-
update from securityonline.info
Apple patched an exploited Apple zero-day vulnerability. Learn how this Apple zero-day vulnerability impacts devices and install emergency u
securityonline.info · 15d ago · September 29th, 2026
Apple patched an exploited Apple zero-day vulnerability. Learn how this Apple zero-day vulnerability impacts devices and install emergency u
via Mastodon https://securityonline.info/exploited-apple-zero-day-vulnerability-cve-2026-86950/?utm_source=mastodon&utm_medium=jetpack_social
-
update from isc.sans.edu
Apple has released urgent security updates for older versions of its software because hackers are actively using a flaw to target users. Ple
isc.sans.edu · 15d ago · September 29th, 2026
Apple has released urgent security updates for older versions of its software because hackers are actively using a flaw to target users. Ple
via Mastodon https://isc.sans.edu/diary/rss/33376
-
mentioned by securityexpress.info
Learn about the critical CVE-2026-86950 zero-day vulnerability patched in iOS 26.7.1. Discover how this CoreGraphics flaw could lead to mali
securityexpress.info · 15d ago · September 29th, 2026
-
mentioned by thehackernews.com
🤖 CVE-2026-86950: out-of-bounds write in Apple CoreGraphics. A maliciously crafted file can lead to arbitrary code execution. Apple says it
thehackernews.com · 14d ago · September 29th, 2026
-
update from securityweek.com
Apple Patches Meta-Reported Zero-Day Linked to ‘Extremely Sophisticated Attack’
securityweek.com · 14d ago · September 29th, 2026
Apple has not said how the malicious file is delivered, but because CoreGraphics handles 2D graphics and PDF rendering across the operating system, it could arrive via web pages, email attachments, or messaging apps, where automatic attachment and link previews could enable zero-click exploitation. No information has been shared on the attacks exploiting CVE-2026-86950, but Apple noted that it learned about the vulnerability from Meta’s product security team. Meta’s involvement is noteworthy given a similar incident from last year, when WhatsApp said a vulnerability in its iOS and macOS apps (CVE-2025-55177) was likely used alongside the Apple ImageIO zero-day CVE-2025-43300 in zero-click attacks aimed at fewer than 200 users. It’s unclear whether the newly patched CoreGraphics flaw was exploited through WhatsApp.
-
update from bleepingcomputer.com
Apple patches CoreGraphics zero-day flaw exploited in attacks
bleepingcomputer.com · 14d ago · September 29th, 2026
Tracked as CVE-2026-20700 , this flaw stems from an out-of-bounds write weakness discovered by Meta Product Security in CoreGraphics, a framework used for two-dimensional vector graphics, image rendering, and text drawing across iOS, macOS, iPadOS, watchOS, and tvOS. Successful exploitation of out-of-bounds write vulnerabilities can let attackers crash a program, corrupt data, or, in the worst case, gain remote code execution by writing data outside the allocated memory buffer. An out-of-bounds write issue was addressed with improved bounds checking." The complete list of devices impacted by this zero-day is extensive, as it impacts both older and newer models, including: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later and Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1 Apple has addressed this issue with improved bounds checking to prevent exploitation in iOS 26.7.1 and iPadOS 26.7.1 , macOS Tahoe 26.7.1
-
mentioned by www.bleepingcomputer.com
Apple patches CoreGraphics zero-day flaw exploited in attacks https:// bleepingcomputer.com/news/security/ apple-patches-coregraphics-zero-d
www.bleepingcomputer.com · 14d ago · September 29th, 2026
-
mentioned by gbhackers.com
Apple Fixes iOS Zero-Day Exploited in Sophisticated Targeted Attacks
gbhackers.com · 14d ago · September 29th, 2026
-
update from cyberpress.org
Apple Patches iPhone CoreGraphics Flaw Allowing Arbitrary Code Execution
cyberpress.org · 14d ago · September 29th, 2026
In security-sensitive code, this memory-safety flaw can corrupt adjacent memory and potentially let an attacker redirect program execution. The company resolved the issue by improving bounds checking, a defensive measure designed to ensure operations stay within valid memory limits. The advisory does not disclose the malicious file format, attack delivery method, affected CoreGraphics code path, technical exploit chain, or the identities of the targets. This limited disclosure is consistent with Apple’s security-update process, under which the company generally withholds vul
-
mentioned by zubiqo.com
Apple just pushed updates for iOS 26.7.1 and macOS Tahoe 26.7.1 to patch a CoreGraphics zero-day that targeted users were dealing with. Meta
zubiqo.com · 14d ago · September 29th, 2026
-
update from socprime.com
CVE-2026-86950: Apple CoreGraphics Zero-Day Linked to Extremely Sophisticated Targeted Attacks
socprime.com · 14d ago · September 29th, 2026
The company has not disclosed who was targeted, how the malicious content was delivered, whether the exploitation attempts succeeded, or who was behind the activity. Because it can process files received through browsers, email clients, messaging applications, document viewers, and other software, a memory-corruption vulnerability in this layer can create a significant attack surface. This class of me
-
update from www.cve.org
CISA has added one vulnerability to the KEV catalogue: - CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability https://w
www.cve.org · 14d ago · September 29th, 2026
CISA has added one vulnerability to the KEV catalogue: - CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability https://w
via Mastodon https://www.cve.org/CVERecord?id=CVE-2026-86950
-
update from secdb.nttzen.cloud
🚨 [CISA-2026:0929] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
secdb.nttzen.cloud · 14d ago · September 29th, 2026
🚨 [CISA-2026:0929] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
via Mastodon https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0929
-
update from www.helpnetsecurity.com
https://www. helpnetsecurity.com/2026/09/29 /apple-core-graphics-zero-day-cve-2026-86950-fixed # ZeroDay # Apple # CyberSecurity # CVE # Cor
www.helpnetsecurity.com · 14d ago · September 29th, 2026
helpnetsecurity.com/2026/09/29 /apple-core-graphics-zero-day-cve-2026-86950-fixed # ZeroDay # Apple # CyberSecurity # CVE # Cor
via Mastodon https://www.helpnetsecurity.com/2026/09/29/apple-core-graphics-zero-day-cve-2026-86950-fixed
-
mentioned by linuxmint.hu
Apple patches CVE-2026-86950, an out-of-bounds write in CoreGraphics that may have been exploited in targeted attacks
linuxmint.hu · 14d ago · September 29th, 2026
-
update from go.dhs.gov
We added Apple out-of-bounds write vulnerability CVE-2026-86950 to the KEV Catalog. Visit https:// go.dhs.gov/Z3Q & apply mitigations to pro
go.dhs.gov · 14d ago · September 29th, 2026
Visit https:// go.dhs.gov/Z3Q & apply mitigations to pro
via X https://go.dhs.gov/Z3Q
-
mentioned by thehackernews.com
🤖 CVE-2026-86950 (CVSS 8.8): out-of-bounds write in Apple CoreGraphics → arbitrary code execution via a maliciously crafted file. Apple repo
thehackernews.com · 14d ago · September 29th, 2026
-
mentioned by dev.to
Apple CoreGraphics CVE-2026-86950: Arbitrary Code Execution via Crafted File Processing, with Exploitation Reported # security # threatintel
dev.to · 14d ago · September 30th, 2026
-
mentioned by support.apple.com
🤖 Apple patches CVE-2026-86950: CoreGraphics out-of-bounds write allowing code execution from a crafted file. Exploited in an "extremely sop
support.apple.com · 13d ago · September 30th, 2026
-
mentioned by beyondmachines.net
Apple Patches Actively Exploited Zero-Day in iOS 26, iPadOS 26 and macOS Apple patched a zero-click vulnerability (CVE-2026-86950) in iOS 26
beyondmachines.net · 13d ago · September 30th, 2026
-
mentioned by www.martincid.com
iOS 26.7.1 patches a flaw that lets one rigged file run code on your iPhone https://www. martincid.com/technology-sv/ap ple-ios-26-7-1-coreg
www.martincid.com · 13d ago · September 30th, 2026
-
mentioned by cybersecurefox.com
CVE-2026-86950: Apple patches CoreGraphics amid targeted attacks 🔗 https:// cybersecurefox.com/en/cve-2026 -86950-apple-coregraphics-targete
cybersecurefox.com · 13d ago · September 30th, 2026
-
update from www.darkreading.com
Apple zero-day vulnerability weaponized in targeted attacks
www.darkreading.com · 13d ago · September 30th, 2026
Dark Reading: Apple zero-day vulnerability weaponized in targeted attacks. Reposted via Mastodon.
-
update from calif.io
CVE-2026-86950: The Great Glyph Grift https:// calif.io/research/the-g reat-glyph-grift …
calif.io · 13d ago · September 30th, 2026
CVE-2026-86950: The Great Glyph Grift https:// calif.io/research/the-g reat-glyph-grift …
via X https://calif.io/research/the-great-glyph-grift
-
mentioned by isc.sans.edu
Apple emergency patch for iOS 26, macOS 26 and macOS 15 (CVE-2026-86950)
isc.sans.edu · 13d ago · September 30th, 2026
-
mentioned by dailytechnow.com
Apple released the urgent iOS 26.7.1 update to patch a critical zero-day vulnerability (CVE-2026-86950) in CoreGraphics, preventing arbitrar
dailytechnow.com · 13d ago · September 30th, 2026
-
mentioned by thehackernews.com
🤖 CVE-2026-86950 (Apple CoreGraphics): first public PoC published. A malicious PDF with a crafted embedded font crashes unpatched iPhones/Ma
thehackernews.com · 12d ago · October 1st, 2026
-
mentioned by www.bitdefender.com
(bitdefender.com) Apple Patches Actively Exploited CoreGraphics Zero-Day Vulnerability in iOS, iPadOS, and macOS In brief - This article ale
www.bitdefender.com · 12d ago · October 1st, 2026
-
mentioned by www.bleepingcomputer.com
That's two Apple zero-days weaponized in the wild this year alone. Your inventory is cursed. Apply Apple's latest security updates immediate
www.bleepingcomputer.com · 11d ago · October 2nd, 2026