CVE-2026-86950: Apple iOS/iPadOS/macOS CoreGraphics RCE (KEV)
CVE-2026-86950 is an out-of-bounds write (CWE-787) in Apple's CoreGraphics framework that lets a maliciously crafted file trigger arbitrary code execution when processed on iOS, iPadOS or macOS, and Apple's own advisory says it is aware of a report that the bug was exploited in an extremely sophisticated attack against specific targeted individuals — language Apple reserves for mercenary-spyware-style campaigns — which is why CISA added it to the Known Exploited Vulnerabilities catalog.
Vulnerability summary
| Vulnerability ID | CVE-2026-86950 |
|---|---|
| CVSS score | 8.8 |
| EPSS score | 0.26166 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2026-09-28T20:17:11.193 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| Apple iOS and iPadOS | cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | Before 18.7.11, and 26.0 up to but not including 26.7.1 (fixed in iOS/iPadOS 18.7.11 or 26.7.1); affects iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later |
| Apple macOS | cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | Before 15.8.1 (macOS Sequoia), and 26.0 up to but not including 26.7.1 (macOS Tahoe) (fixed in macOS Sequoia 15.8.1 or macOS Tahoe 26.7.1) |
What this means
CVE-2026-86950 affects the CoreGraphics framework shared across Apple's iOS, iPadOS and macOS. NVD's description states that "an out-of-bounds write issue was addressed with improved bounds checking," fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1, and that "processing a maliciously crafted file may lead to arbitrary code execution" (NVD).
Apple's own security-release notes for all three affected platforms repeat the same impact statement and add: "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." The fix is credited to Meta's Product Security team and the notes record a release date of September 28, 2026 (Apple Security Release Notes, 149228, 149229).
NVD has analysed the CVE and recorded CPE applicability, but it has not published its own Primary CVSS metric; the only score NVD lists is a Secondary metric contributed by CISA's enrichment program (an Authorized Data Publisher), not by Apple — Apple's own advisory text does not quote a CVSS number at all, consistent with Apple's usual practice. That Secondary metric is CVSS v3.1 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — network vector, low complexity, no privileges, but user interaction is required (opening or receiving the crafted file) (NVD).
CISA added CVE-2026-86950 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-29, with a required-action due date of 2026-10-13, describing it as "an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution" and listing known ransomware campaign use as "Unknown" — consistent with a targeted-surveillance use case rather than mass ransomware (CISA KEV).
As of 2026-10-27, FIRST scores the probability of exploitation at 0.26166 (97.984th percentile) — notably elevated for a bug that required user interaction, reflecting its documented use in a targeted attack (FIRST EPSS).
Because this bug has already been used against specific targeted individuals, any device on an affected iOS, iPadOS or macOS build should be updated to the fixed release immediately, with particular urgency for users who may be high-risk targets (journalists, activists, dissidents, executives).
Evidence
- Out-of-bounds write (CWE-787) in CoreGraphics, fixed with improved bounds checking; processing a maliciously crafted file may lead to arbitrary code execution. — NVD
- Apple is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27; fix credited to Meta Product Security, released 2026-09-28. — Apple Security Release Notes
- The only CVSS metric NVD lists is a Secondary (not NVD Primary) score contributed via CISA's enrichment program, not Apple: CVSS v3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-29, required action due 2026-10-13, known ransomware campaign use listed as Unknown. — CISA KEV
- EPSS score is 0.26166 (97.984th percentile) as of 2026-10-27. — FIRST EPSS