CVE intelligenceCISA KEV

CVE-2026-86950

Apple Multiple Products Out-of-Bounds Write Vulnerability

Published Sep 28, 2026Sources checked Nov 13, 2026

8.8HIGHCVSS out of 10

What this means

Actively exploited

CISA lists CVE-2026-86950 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Apple Multiple Products.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploit: Not collected.

Apple Security Releases: Possible exploitation reported by Apple Security Releases (2026-10-26)
Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
The Hacker News: Possible exploitation reported by The Hacker News (2026-09-28)
Apple reports possible exploitation of CoreGraphics CVE-2026-86950 in sophisticated attacks against specific individuals on iOS versions before iOS 27. Apple qualifies this as possible exploitation; it is not an assertion of confirmed attacks across every affected platform.
Apple Security Releases: Possible exploitation reported by Apple Security Releases (2026-09-28)
Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
Apple Security Releases: Possible exploitation reported by Apple Security Releases (2026-09-28)
Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
Apple Security Releases: Possible exploitation reported by Apple Security Releases (2026-09-28)
Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

What to do next

Remediation and response

Review the linked vendor advisory and apply the mitigation or fixed release for your affected product.

CISA KEVListedObserved exploitation

EPSS26.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors1Source-linked actor relationships

Overview

What is CVE-2026-86950?

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1.

Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

Source: NVD

Reported activity: Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
Apple Security Releases · Published Oct 26, 2026

CISA says:Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.CISA catalog due date Oct 13, 2026