Table of contents
17
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member)
Read this in 30 seconds: CVE-2026-86950 is an out-of-bounds write in Apple’s CoreGraphics framework. Processing a maliciously crafted file may lead to arbitrary code execution. Apple fixed it on September 28, 2026, and says it may have been exploited in an extremely sophisticated attack against specific targeted individuals. CISA added it to its Known Exploited Vulnerabilities catalog on September 29, with a deadline of October 13, which is today.
- Update now. The fixed releases are iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
- Exploitation is reported, not detailed. Apple’s statement is the only exploitation source we found. It does not say which apps, which files or how many devices.
- No workaround is in Apple’s advisories. The fix is the update. We found no mitigation to use instead.
- No indicators were published. Apple’s advisories list no IOCs, so we cannot give you a hunt that would prove a device is clean.
- CISA did not flag forensic triage. The KEV entry sets the forensic-triage field to No, unlike some older entries we have covered.
Once a file-handling bug is reported as exploited, the unpatched devices are the ones that matter.
CoreGraphics is the part of Apple’s operating systems that draws and processes images and graphics. Most people never see it run, which is why a bug in it can be easy to forget. That is the context for CVE-2026-86950, and it explains why a free update still matters.
This article covers what the bug is according to Apple, which versions are fixed, what Apple says about exploitation and what it does not say, how to check your devices, and what we could not verify.
Apple’s security notes describe the bug in one line. “Processing a maliciously crafted file may lead to arbitrary code execution.” The description is “An out-of-bounds write issue was addressed with improved bounds checking.” Apple lists the component as CoreGraphics and credits “Meta Product Security” for the report.
An out-of-bounds write is a memory-safety bug. The program writes data outside the memory area it allocated, which can corrupt nearby data or change how the program runs. Apple does not publish the exact code path, and we will not reconstruct one. For a defender, the important part is the impact Apple states: a crafted file can lead to code execution.
The National Vulnerability Database records the weakness as CWE-787, which is out-of-bounds write. NVD’s secondary CVSS 3.1 score is 8.8, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. That vector means a network attack, low complexity, no privileges needed, and user interaction required. Apple does not publish a CVSS score in its advisories, so treat the 8.8 as NVD’s assessment, not Apple’s.
CISA’s catalog entry is dated September 29, 2026. It carries a due date of October 13, 2026, which is today, and the forensic-triage field is set to No. The ransomware field is “Unknown.” The entry’s notes link to Apple’s three security notes and to NVD.
The catalog entry does not state why CISA listed this bug. The only exploitation statement we found is Apple’s own, quoted above. We did not find a separate CISA statement with more detail, and we did not find a published exploitation write-up from a researcher.
Apple’s advisories list four fixed releases, all released on September 28, 2026:
| Apple release | Fixed version | Apple advisory |
|---|---|---|
| iOS | 26.7.1 | 149226 |
| iPadOS | 26.7.1 | 149226 |
| macOS Tahoe | 26.7.1 | 149228 |
| macOS Sequoia | 15.8.1 | 149229 |
Apple’s iOS and iPadOS advisory lists the devices it covers, from iPhone 11 and later, and several iPad models. It does not list older releases that are still affected. Older Apple releases are not stated in the pages we read.
The NVD configuration data does not agree with itself. It lists iOS and iPadOS before 26.7.1 as affected, and macOS 26.0 up to 26.7.1. It also lists macOS 15.8.1 as an exact version match, which is not how a range reads. We did not resolve that from the sources we have. Use Apple’s fixed list as the line to act on, and move each device to the fixed release on its own line.
Apple’s wording on exploitation is the statement that matters most here. The advisory says Apple “is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.”
Three things are missing from that statement. It does not say which apps or file types were used. It does not say how many devices were affected. It does not say who the targeted individuals were, and we will not guess. Apple’s wording refers to versions of iOS before iOS 27, and the advisory does not explain what that means for devices on other releases. We did not verify it beyond quoting it.
The full-disclosure mailing-list copy of the advisory mentions no public proof of concept. We did not find one in the sources we read. We are not going to describe how the bug could be triggered.
The KEV catalog lists 95 Apple entries in the version we pulled, released October 8, 2026. Ten of them are named as out-of-bounds write bugs. This is the second KEV entry that names CoreGraphics. The earlier one is CVE-2021-30860, added on November 3, 2021.
The count is a pattern check, not a forecast. Apple has had many memory-safety bugs in its image and document handling, and KEV reflects the ones that CISA has linked to exploitation. A single fix does not make a device safe from the next one, which is why the update habit matters more than any one patch.
You are exposed if your device runs one of the affected releases. Apple’s exploitation note concerns versions of iOS before iOS 27, and the NVD data points to earlier macOS and iPadOS builds. Compare your version with the fixed list above, not with the date on your device.
Apple’s trigger is a crafted file. CoreGraphics is a shared system framework, so the file could reach a device through many routes, including documents, images and messages. Apple does not list the apps that can reach the bug, and we will not guess at them. For planning purposes, treat any unpatched device that opens files from outside your control as exposed.
The risk is higher if you handle sensitive material. Apple’s own note describes a targeted attack, which is a reason to update quickly if your work makes you a likely target. That is our conclusion from Apple’s wording, not a claim about any particular group.
Work through these in order:
The KEV required-action text says to apply mitigations in line with vendor instructions. For this bug, the vendor instruction we found is the update.
These commands confirm patch level. They do not detect exploitation, so run them as a check on your version, not as a test for compromise.
On a Mac, show the current version and build:
# Show the macOS product version and build on this Mac
sw_versList the updates Apple reports as available, and check the update history to confirm that a security update installed:
# List available macOS updates, then review what has been installed
softwareupdate --list
softwareupdate --historyOn an iPhone or iPad, open Settings, then General, then About for the version, or Settings, then General, then Software Update to install the fix.
Apple’s advisories do not list indicators of compromise, and the mailing-list copy does not either. We will not invent a hunt, because a made-up search for a bug like this produces false confidence in either direction.
What you can do is confirm the patch level on every device, keep the update history, and report anything unusual to your security team with the device model and version. If Apple or a researcher publishes indicators later, this section should be updated to use them.
Patch-level inventory is the first thing to check on a bug like this, and it is part of the work in our AI VAPT services. A penetration test documents what was tested. It does not certify that a device is patched or clean, and it does not replace the update.
CVE-2026-86950 is an out-of-bounds write in Apple’s CoreGraphics framework. Processing a maliciously crafted file may lead to arbitrary code execution. Apple fixed it on September 28, 2026. NVD classifies it as CWE-787.
Apple says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. CISA lists it in the Known Exploited Vulnerabilities catalog, with a September 29 entry date and an October 13 deadline. Neither source gives the details of the attack.
iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, all released September 28, 2026. Check the fixed list for your own product line, and install the newest release, since it should include the fix.
NVD’s secondary CVSS 3.1 vector marks user interaction as required, and Apple’s description depends on processing a maliciously crafted file. Opening a file is one way that happens, but Apple does not list every path, so do not treat a lack of interaction as protection.
Confirm your patch level first. Apple’s advisories list no indicators of compromise, so there is no published search to run. A clean check does not prove the device was never targeted. Installing the patch fixes the bug, but it does not show whether it was used before.
CVE-2026-86950 is an Apple CoreGraphics bug that can lead to code execution from a crafted file. Apple says it may have been exploited in a targeted attack, and CISA lists it as exploited, with a deadline of today.
Check your version against the fixed list, install the update on every device, and confirm it took. Apple’s advisories do not give indicators to hunt for, so the patch is the step you can verify.
Categories
Related articles
