CVE-2026-86950
HIGH · 8.8 KEV EPSS 26.2%Confirmed in-the-wild exploitation, KEV-listed, urgent vendor patching, credible targeted attack reports.
What: Out-of-bounds write in CoreGraphics (iOS 26, iPadOS 26, macOS Sequoia/Tahoe) leading to arbitrary code execution. CVSS 8.8 HIGH. Apple confirms in-the-wild exploitation in targeted attacks before iOS 27 release.
Why it matters: KEV-listed same day as patch (2026-09-29). Apple issued emergency updates within hours of disclosure. NVD notes "extremely sophisticated attack" against specific individuals. Zero-day with confirmed real-world weaponization.
Where it's seen: Multilingual social chatter across Bluesky citing Apple's official Sept 28 emergency patches, CISA KEV addition, and SecurityWeek/tech press coverage. Meta flagged the vulnerability. Defender urgency evident in update guidance posts.
RISK: CRITICAL — Zero-day exploited in sophisticated targeted attacks; KEV-listed; emergency patches issued same day.
Description
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High