Out-of-Bounds Write Vulnerability in Apple's iOS, iPadOS, and macOS
CVE-2026-86950

8.8HIGH

Key Information:

Vendor

Apple
Status
iOS And iPad OS
Mac OS
Vendor
CVE Published:
28 September 2026

Badges

🥇 Trended No. 1📈 Trended📈 Score: 32,700💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 26%🦅 CISA Reported📰 News Worthy

What is CVE-2026-86950?

CVE-2026-86950 is an out-of-bounds write vulnerability identified in Apple's iOS, iPadOS, and macOS systems. This vulnerability arises when the software improperly validates bounds, potentially allowing attackers to manipulate memory. When exploited, it could enable arbitrary code execution, which means that an adversary could run malicious code on the affected device. This issue impacts the security and integrity of systems running affected versions of Apple's operating systems, potentially leading to unauthorized access and control. The vulnerability has been addressed with an update in iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1 to improve bounds checking and mitigate the risks associated with this flaw.

Potential impact of CVE-2026-86950

  1. Arbitrary Code Execution: Successful exploitation of this vulnerability could allow attackers to execute arbitrary code, potentially leading to the installation of malware, unauthorized data access, or control over the affected devices.

  2. Targeted Attacks: The vulnerability has been associated with sophisticated targeted attacks against specific individuals, raising concerns for high-profile users, organizations, and businesses, which could face greater risks of data breaches and espionage.

  3. Reputation and Trust Erosion: If exploited, the resulting security incidents could damage the reputation of organizations relying on Apple's products, leading to a loss of customer trust and potential financial ramifications stemming from compromised data and operational disruptions.

CISA has reported CVE-2026-86950

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-86950 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

iOS and iPadOS 0 < 18.7.11

iOS and iPadOS 0 < 26.7.1

macOS 0 < 15.8.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-86950-POC
Created by jpdagostin0

News Articles

favicon imageThe Hacker News

Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads

Apple backports fixes for CVE-2026-86950 to older iPhones and iPads after reports of possible targeted exploitation of the CoreGraphics flaw.

2 weeks ago

favicon imageBleepingComputer

Apple backports CoreGraphics zero-day patches to older iPhones

​Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in

2 weeks ago

favicon imageSlashgear

The Latest iOS 26 Update Blocks A Serious Security Threat For iPhone Users - SlashGear

Apple released iOS 26.7.1 to patch CVE-2026-86950, a critical Core Graphics flaw enabling arbitrary code execution that was added to CISA's KEV catalog.

References

https://support.apple.com/en-us/149225
https://support.apple.com/en-us/149226
https://support.apple.com/en-us/149228

EPSS Score

26% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 🥇

    Vulnerability reached the number 1 worldwide trending spot

  • 💰

    Used in Ransomware

  • 📈

    Vulnerability started trending

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • 📰

    First article discovered by The Hacker News

  • Vulnerability published

  • Vulnerability Reserved

.