Out-of-Bounds Write Vulnerability in Apple's iOS, iPadOS, and macOS
CVE-2026-86950

8.8HIGH

Key Information:

Vendor

Apple
Status
iOS And iPad OS
Mac OS
Vendor
CVE Published:
28 September 2026

Badges

🥇 Trended No. 1📈 Trended📈 Score: 32,700💰 Ransomware👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2026-86950?

CVE-2026-86950 is an out-of-bounds write vulnerability identified in Apple's iOS, iPadOS, and macOS systems. This vulnerability arises when the software improperly validates bounds, potentially allowing attackers to manipulate memory. When exploited, it could enable arbitrary code execution, which means that an adversary could run malicious code on the affected device. This issue impacts the security and integrity of systems running affected versions of Apple's operating systems, potentially leading to unauthorized access and control. The vulnerability has been addressed with an update in iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1 to improve bounds checking and mitigate the risks associated with this flaw.

Potential impact of CVE-2026-86950

  1. Arbitrary Code Execution: Successful exploitation of this vulnerability could allow attackers to execute arbitrary code, potentially leading to the installation of malware, unauthorized data access, or control over the affected devices.

  2. Targeted Attacks: The vulnerability has been associated with sophisticated targeted attacks against specific individuals, raising concerns for high-profile users, organizations, and businesses, which could face greater risks of data breaches and espionage.

  3. Reputation and Trust Erosion: If exploited, the resulting security incidents could damage the reputation of organizations relying on Apple's products, leading to a loss of customer trust and potential financial ramifications stemming from compromised data and operational disruptions.

CISA has reported CVE-2026-86950

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-86950 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

iOS and iPadOS 0 < 26.7.1

macOS 0 < 15.8.1

macOS 0 < 26.7.1

News Articles

favicon imageSlashgear

The Latest iOS 26 Update Blocks A Serious Security Threat For iPhone Users - SlashGear

Apple released iOS 26.7.1 to patch CVE-2026-86950, a critical Core Graphics flaw enabling arbitrary code execution that was added to CISA's KEV catalog.

2 weeks ago

favicon imageSwapupdate

Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path - SwapUpdate

Security researchers have published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw Apple says may have been used in attacks

2 weeks ago

favicon imageTimes Now News

Govt Warns Apple Users In India Of Sophisticated Attacks: Update Your iPhone, iPad And Mac Immediately

A critical security alert has been issued for Apple device users, including iPhones, iPads, and Macs, regarding a serious vulnerability identified as CVE-2026-86950.., Technology & Science, Times Now

2 weeks ago

References

https://support.apple.com/en-us/149226
https://support.apple.com/en-us/149228
https://support.apple.com/en-us/149229

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🥇

    Vulnerability reached the number 1 worldwide trending spot

  • 💰

    Used in Ransomware

  • 📈

    Vulnerability started trending

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • 📰

    First article discovered by The Hacker News

  • Vulnerability published

  • Vulnerability Reserved

.