Apple CoreGraphics Code Execution Exploited on iOS (CVE-2026-86950)

TL;DR

• CVE-2026-86950 is an out-of-bounds write in CoreGraphics, Apple's graphics framework. Processing a maliciously crafted file can lead to arbitrary code execution. CISA, as an Authorized Data Publisher (ADP) in the CVE record, rates it CVSS v3.1 8.8, High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
• Apple states the flaw "may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27", CISA's ADP records exploitation as active, and CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on September 29, 2026.
• That wording points to targeted attacks rather than opportunistic scanning; no campaign or actor has been publicly identified, and no mass exploitation has been reported.
• The fix shipped on September 28, 2026 in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1; iOS and iPadOS 27 are outside the affected set. On October 26, 2026 Apple backported the fix to the iOS and iPadOS 18 line, in iOS and iPadOS 18.7.11.
• Update now, starting with the older fleet. The iPhone XS, XS Max and XR and the iPad 7th generation cannot run iOS or iPadOS 26, so they stay on the 18 line. They, like every other device still on that line, only got the fix on October 26. Any of them that missed that update is still exposed to a flaw that has already been used against people.

Am I affected?

You are affected if your device runs a version older than the fixed release for its line. iOS and iPadOS 17 and earlier have no published fix for this CVE. Careful use does not remove the exposure.

Apple's exploitation statement covers "versions of iOS before iOS 27", and the CVE record lists no affected iOS 27 versions.

For iOS and iPadOS, the CVE record's affected range starts at version 0, so it also covers releases older than the 18 line, and neither the record nor Apple's security releases list a fix for them. A device that cannot run iOS or iPadOS 18 therefore stays exposed, and the only way to get the fix is to move to hardware that can run a fixed release.

Apple's security content page lists these devices for the October backport. The iPhone XS, XS Max and XR and the iPad 7th generation cannot run iOS or iPadOS 26; the other iPads listed can, so 18.7.11 is the fix for those left on the 18 line:

• iPhone XS, iPhone XS Max and iPhone XR
• iPad 7th generation
• iPad Air 4th generation and later
• iPad 9th generation and later
• iPad mini 6th generation and later

Check the version on the device itself:

Settings > General > Software Update          # iOS and iPadOS: shows the pending update
Settings > General > About                    # iOS and iPadOS: shows the installed version
System Settings > General > Software Update   # macOS: shows the pending update
System Settings > General > About             # macOS: shows the installed version
sw_vers -productVersion                       # macOS: prints the installed version, scriptable

For a fleet, compare the MDM inventory’s osVersion values against the fixed versions in the table above and follow up on every device below its required version.

How do I fix it?

Install the fixed release for the device's line: iOS and iPadOS 26.7.1 or later, iOS and iPadOS 18.7.11 or later, macOS Sequoia 15.8.1 or later, or macOS Tahoe 26.7.1 or later. For iOS and iPadOS 17 or earlier, upgrade to a supported fixed release; if the hardware cannot run one, replace the device.

• Managed iPhones, iPads and Macs: push the update from your MDM (the ScheduleOSUpdate command or the Software Update declarative configuration in declarative device management), then confirm the reported osVersion in inventory.
• Unmanaged iPhones and iPads: Settings > General > Software Update.
• Unmanaged Macs: System Settings > General > Software Update, or sudo softwareupdate --install --all --restart in Terminal (--all installs every pending update, not only this fix). Then confirm with sw_vers -productVersion: 15.8.1 or later on Sequoia, 26.7.1 or later on Tahoe.

There is no configuration change that removes the vulnerability: the flaw is in file parsing, which every device does.

If a device genuinely cannot be updated today, one measure reduces, but does not remove, the risk, and one common control does not help:

• Enable Lockdown Mode on the devices of users who could plausibly be targeted: Settings > Privacy & Security > Lockdown Mode on iOS and iPadOS, System Settings > Privacy & Security > Lockdown Mode on macOS. It restricts many attack surfaces. Apple does not claim Lockdown Mode blocks this CVE specifically, and the delivered file in this campaign has not been described publicly, so treat it as reducing exposure rather than closing the flaw.
• Gatekeeper and notarization do not cover this flaw. Apple's Platform Security guide describes them as checks on downloaded software before it opens, not on the files CoreGraphics parses, so on an unpatched Mac the vulnerable parse stays reachable. Keep them on for what they do cover, but they are no substitute for the update.

What is the root cause?

CoreGraphics wrote attacker-controlled data past the end of the buffer it had allocated when parsing a maliciously crafted file; Apple describes the fix only as "improved bounds checking".

That sentence is the complete public root cause, and it is worth being explicit about why: Apple has not published the vulnerable code, the patch, the file format involved, or any technical analysis. The public record for CVE-2026-86950 consists of Apple's four security-content pages and the CVE record, plus press coverage that restates them. CISA's ADP adds the CVSS v3.1 8.8 score and its exploitation assessment.

What the disclosed facts establish:

• CoreGraphics is Apple's 2D drawing and image-processing framework, which also handles PDFs across iOS, iPadOS and macOS.
• The trigger is processing a crafted file, meaning the data that overflows the buffer arrives inside content the device was asked to open.
• The impact is arbitrary code execution, which for an out-of-bounds write in a parser means the overflowing bytes land in adjacent memory in a way the attacker can shape.

What they do not establish:

• Which image or file format the crafted file used.
• Which parsing path lacked the check.
• Whether the flaw is reachable from a message preview (which parses attachments automatically) or requires the user to open the file.
• Whether the in-the-wild attacks chained it with anything else.

The CVSS vector's UI:R records that user interaction is required, so some action by the user is part of the chain as CISA scored it; which action, opening the file or only previewing it, is not public.

How is it exploited?

Apple's statement supports only the shape of the attack: an attacker crafted a file, it reached a targeted individual's device, and CoreGraphics processed it in a way that wrote outside allocated memory. Beyond that shape the mechanics are not public, even though the exploitation already happened, against specific people. Apple's phrasing, "may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27", appears verbatim in both the September releases and the October backport. CISA's ADP marked exploitation active on September 30, 2026.

There is no public proof of concept, no published sample, and no analysis of the attack, so any claim about the delivery channel, the exact malformed structure, or the post-exploitation steps would be invention. This post does not make those claims, and readers should treat vendor posts that fill those gaps with specifics as unverified unless they cite a source that has them.

What can be said about the class, without claiming it for this case: an out-of-bounds write in a widely used framework like CoreGraphics is a valuable targeted-attack primitive. Its parsing surface is reachable from ordinary content handling. Once code runs in the process that parsed the file, the implant inherits that process's sandbox and data access. That is exactly the market that mercenary spyware serves, and it is consistent with, though not proven by, Apple's "specific targeted individuals" wording.

What is the attack flow?

A crafted file reaches a targeted device, the user's interaction brings it into CoreGraphics, and an out-of-bounds write during the parse turns it into code execution.

The failure is the insufficient bounds check (step E in the diagram), and Apple's "improved bounds checking" targets it. The steps between A and C, the delivery path, are not public for this campaign.

What can an attacker do?

The attacker gets arbitrary code execution in whatever process parsed the file, and that process's sandbox defines the initial reach. On iOS that typically means one app's data; reaching messages, mail, photos or the Keychain requires a privileged parsing context or further exploitation.

On macOS, the Tahoe 26.7.1 and Sequoia 15.8.1 pages give the same impact, arbitrary code execution from a maliciously crafted file, with the code running under the access of the process that parsed it. Their exploitation statement still refers only to versions of iOS before iOS 27, and Apple has not said that Macs were attacked.

Apple does not describe what the observed attackers did after execution, so the observed reach in this campaign is unknown, and no list of affected individuals or indicators of compromise has been published.

The known conditions for the attack:

• The victim runs an affected line below its fix: iOS and iPadOS 26.x before 26.7.1, iOS and iPadOS 18.x before 18.7.11, macOS Sequoia before 15.8.1, or macOS Tahoe before 26.7.1.
• The victim interacts with the crafted content (the UI:R in CISA's vector).
• The attacker is selective: Apple says "specific targeted individuals" in "an extremely sophisticated attack". No broad exploitation, scanning campaign or victim reporting has been published.

Why does the fix work?

A bounds check verifies, before each write, that the whole range being written, from the destination address through the last byte the write touches, stays inside the buffer the code allocated. Apple's entire engineering statement is "an out-of-bounds write issue was addressed with improved bounds checking". If the improved check covers the path that overflowed, data derived from a crafted file can no longer be written past that buffer, which removes the memory corruption and, with it, the code-execution primitive built on that write.

Apple has published no patch diff, so the completeness of the fix cannot be verified from public material.

Apple lists CVE-2026-86950 as addressed in the September 28 releases (iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1) and in the October 26 backport (iOS and iPadOS 18.7.11). This confirms fixes for the same vulnerability across those release lines, four weeks apart; it does not establish that their patch implementations are identical.

How do I check if I was compromised?

No indicators of compromise have been published for CVE-2026-86950, so there is no artifact, file hash, domain or process to hunt for, and any post claiming otherwise is speculating. For users who have reason to believe they were targeted, the practical steps are the general ones for suspected mercenary spyware:

• Install the fixed release to close the known vulnerability. An update does not establish whether the device was previously compromised or remove the need for investigation.
• Review installed configuration profiles under Settings > General > VPN & Device Management. Check unfamiliar profiles with your administrator; legitimate MDM profiles may be installed by your organization. A profile alone neither proves nor rules out exploitation of this CVE.
• On iOS, enable Lockdown Mode if the threat against this user is plausible; Apple documents what it changes.
• If the suspicion is specific and current, get expert help rather than relying on a checklist. Apple advises targeted users to enlist expert help, such as the Digital Security Helpline at the nonprofit Access Now, and says these attacks are much harder to detect and prevent than regular cybercriminal activity (Apple threat notifications page).

Timeline

• 2026-09-28: Apple releases iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1 with the fix, already carrying the "may have been exploited in an extremely sophisticated attack against specific targeted individuals" statement (Apple security content pages).
• 2026-09-29: CISA adds CVE-2026-86950 to the KEV catalog, with a remediation due date of October 13, 2026 for federal agencies; that deadline had already passed when this post was published (CISA KEV catalog).
• 2026-09-30: CISA's ADP scores CVE-2026-86950 CVSS v3.1 8.8 and records SSVC (Stakeholder-Specific Vulnerability Categorization) exploitation as active, which in SSVC means shared, observable and reliable evidence that threat actors have used the exploit in the wild (CVE record, CISA SSVC guide).
• 2026-10-26: Apple backports the fix to older devices in iOS and iPadOS 18.7.11, alongside CVE-2026-65339 (an Audio logic issue that could let an app leak sensitive user information) and CVE-2026-86990 (a CoreMedia access issue that could let a malicious app reach the camera without permission) (Apple KB 149225).
• 2026-10-28: this post.

The four-week gap matters for fleet management: devices left on iOS 18 remained without a published fix after iOS 26 received one. Confirm the installed version on older devices instead of assuming that the September update campaign covered them. The public record does not establish which devices an attacker would target next.

FAQ

Who discovered CVE-2026-86950?

Apple credits the discovery of CVE-2026-86950 to Meta Product Security.

Who exploited CVE-2026-86950?

Who exploited CVE-2026-86950 is not public: Apple's statement describes the attack ("extremely sophisticated", "specific targeted individuals") but names no actor, and no researcher or government has published an attribution for this CVE.

I am on iOS 26.7.1 or later. Do I need iOS 18.7.11?

No. iOS 18.7.11 is the fix for devices on the 18 line, including those that cannot run iOS 26, such as the iPhone XS, XS Max and XR. If your device reports iOS 26.7.1 or later, or iPadOS 26.7.1 or later, you already have the fix. Devices on iOS 27 are outside the affected set per Apple's wording.

Is CVE-2026-86950 in the CISA KEV catalog?

Yes. CISA added CVE-2026-86950 to the KEV catalog on September 29, 2026, with a remediation due date of October 13, 2026 for federal agencies; that deadline has passed. CISA's ADP also scored the CVE, and its September 30, 2026 assessment records exploitation as active.

What are the other two CVEs in iOS 18.7.11?

CVE-2026-65339 is a logic issue in the Audio component that could let an app leak sensitive user information, credited to Mustafa Calap and Meta Red Team X's Nik Tsytsarkin. CVE-2026-86990 is an access issue in CoreMedia that could let a malicious app access the camera without user permission, credited to Mustafa Calap. Neither carries an in-the-wild statement; they ride along with the CoreGraphics fix in the same release.

Why does Apple say so little about CVE-2026-86950?

Apple's published policy is that, for the protection of its customers, it does not "disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are generally available". It does not explain why its advisories stay short after release; in practice they carry the impact, the fix wording and the credit, and nothing that would help reproduce the attack. For this CVE that means the component (CoreGraphics), the class (out-of-bounds write), the trigger (a maliciously crafted file) and the exploitation statement are the full public record; this post states explicitly where that record ends rather than filling the gaps with guesses.

References

• Apple security content for iOS 18.7.11 and iPadOS 18.7.11, released October 26, 2026, the CoreGraphics entry with the exploitation statement and the Meta Product Security credit, read in full: https://support.apple.com/en-us/149225 (checked October 28, 2026)
• Apple security content for iOS 26.7.1 and iPadOS 26.7.1, released September 28, 2026: https://support.apple.com/en-us/149226
• Apple security content for macOS Tahoe 26.7.1, released September 28, 2026: https://support.apple.com/en-us/149228
• Apple security content for macOS Sequoia 15.8.1, released September 28, 2026: https://support.apple.com/en-us/149229
• CVE record for CVE-2026-86950, CISA ADP CVSS v3.1 8.8 and SSVC exploitation "active", September 30, 2026: https://cveawg.mitre.org/api/cve/CVE-2026-86950 (checked October 28, 2026)
• CISA, Stakeholder-Specific Vulnerability Categorization (SSVC) Guide, definition of the exploitation value "active": https://www.cisa.gov/sites/default/files/publications/cisa-ssvc-guide%20508c.pdf (checked October 28, 2026)
• CISA Known Exploited Vulnerabilities catalog, CVE-2026-86950 added September 29, 2026: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86950 (checked October 28, 2026)
• The Hacker News, "Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads", October 27, 2026: https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html
• Apple security releases, with Apple's disclosure policy: https://support.apple.com/en-us/100100 (checked October 28, 2026)
• Apple Platform Security, Gatekeeper and runtime protection in macOS: https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web (checked October 28, 2026)
• Apple, About Lockdown Mode: https://support.apple.com/guide/personal-security/about-lockdown-mode-sec973aee0d0/web
• Apple, About Apple threat notifications and protecting against mercenary spyware: https://support.apple.com/en-us/102174 (checked October 28, 2026)