Apple CoreGraphics Out-of-Bounds Write Vulnerability (CVE-2026-86950)

A critical vulnerability, identified as CVE-2026-86590, has been discovered in Apple CoreGraphics. The vulnerability is caused by an out-of-bounds write issue when processing maliciously crafted files. Successful exploitation could allow an attacker to execute arbitrary code on an affected device. Apple has released security updates to address the vulnerability. Users and system owners are strongly advised to update affected Apple devices immediately to reduce potential risks.

Vulnerability

• Apple CoreGraphics Out-of-Bounds Write Vulnerability (CVE-2026-86950)
  • Apple is aware of reports that this vulnerability may have been exploited in an extremely sophisticated attack against specific targeted individuals using versions of iOS before iOS 27.

Severity Level

• Critical

Affected Products

• iOS and iPadOS prior to 26.7.1
  • iPhone 11 and later
  • iPad Pro 12.9-inch 3rd generation and later
  • iPad Pro 11-inch 1st generation and later
  • iPad Air 3rd generation and later
  • iPad 8th generation and later
  • iPad mini 5th generation and later
• macOS Tahoe prior to 26.7.1
• macOS Sequoia prior to 15.8.1

Remediation

• Update affected Apple devices immediately:
  • Upgrade to iOS 26.7.1 or iPadOS 26.7.1, or upgrade to the latest available major OS version supported by the device.
  • Upgrade systems running macOS Tahoe to macOS Tahoe 26.7.1 or later.
  • Upgrade systems running macOS Sequoia to macOS Sequoia 15.8.1 or later.
• Verify that the security update has been installed successfully instead of assuming that automatic updates have completed.
• Avoid opening unexpected attachments or files received from unknown or untrusted sources.

Reference

• NVD: CVE-2026-86950
• HKCERT: Apple Products Remote Code Execution Vulnerability
• Apple: About the security content of iOS 26.7.1 and iPadOS 26.7.1
• Apple: About the security content of macOS Tahoe 26.7.1
• Apple: About the security content of macOS Sequoia 15.8.1
• The Hacker News: Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks

Published on: 30 Sep 2026