Search/CVE-2026-86950
● CVE — High

CVE-2026-86950

VendorappleProductmacos, iphone os, ipadosDiscoveredSep 28, 2026UpdatedOct 1, 2026

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

View graph Watch Export
CVSS v3.1
8.8 HIGH
EPSS
1.24%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
12
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Sep 30, 2026 → Oct 2, 2026
▲ 0.43pp
0.81% → 1.24% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Connections
17 relationships
Timeline
disclosure → media coverage
Sep 28, 2026
thehackernews.com reports: Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks
Sep 28, 2026
Disclosure — published as a CVE record.
Sep 28, 2026
isc.sans.edu reports: Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th)
Sep 29, 2026
securityweek.com reports: Apple Patches Zero-Day Linked to ‘Extremely Sophisticated Attack’
Sep 29, 2026
bleepingcomputer.com reports: Apple patches CoreGraphics zero-day flaw exploited in attacks
Sep 29, 2026
acn.gov.it reports: Apple: rilevato sfruttamento in rete della CVE-2026-86950
Sep 29, 2026
malwarebytes.com reports: Update your iPhone, iPad, or Mac: Flaw could run attackers’ code
Sep 29, 2026
theregister.com reports: Apple patches CoreGraphics zero-day already exploited in targeted attacks
Sep 29, 2026
darkreading.com reports: Apple Zero-Day Vulnerability Weaponized in Targeted Attacks
Sep 30, 2026
infosecurity-magazine.com reports: Apple Patches CoreGraphics Zero Day Exploited in Attacks
Oct 1, 2026
thehackernews.com reports: Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path
Oct 4, 2026
helpnetsecurity.com reports: Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited
Oct 5, 2026
research.checkpoint.com reports: 5th October – Threat Intelligence Report
Public PoC (6)
github.com/34zY/CVE-2026-86950github.com/msuiche/hotcellgithub.com/java99999/CVE-2026-86950-POCgithub.com/decalage2/detect_CVE-2026-86950github.com/0xBlackash/CVE-2026-86950github.com/jpdagostin0/CVE-2026-86950-POC
Unverified third-party code — review before executing.