CVE-2026-86950 Apple Multiple Products: Apple Multiple Products Out-of-Bounds Write Vulnerability

1. Executive summary

Apple has patched CVE-2026-86950, an out-of-bounds write in the CoreGraphics framework affecting iOS, iPadOS and macOS, which Apple states may have been exploited in an "extremely sophisticated attack" against specific targeted individuals on iOS versions before iOS 27. The vulnerability carries a CVSS score of 8.8 (HIGH) and is listed in CISA KEV with an addition date of 2026-09-29; EPSS sits at 1%. The flaw is reached by processing a maliciously crafted file, so the exposure surface is not a network service but the routine handling of images and PDFs across mail, messaging, browser and document workflows. For EMEA financial services, the practical risk is concentrated in a small number of senior, high-value or otherwise targeted staff on unpatched Apple endpoints, not in the general user population. The vendor fix is available now and the KEV remediation due date is 2026-10-02.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 17: ICT-related incident management process	CVE-2026-86950 is in CISA KEV and Apple states it may have been exploited in targeted attacks; if a client endpoint was compromised via this flaw, the incident must be handled through the ICT-related incident management process.	Clients must be able to demonstrate that a suspected exploitation of this flaw was detected, logged, contained and escalated through a defined process, not handled ad hoc by the endpoint team.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities	A confirmed compromise of a targeted individual via this flaw may meet the major-incident threshold and require reporting to the competent authority.	Clients need the classification decision and the reporting clock documented before an incident, since the trigger here is a confirmed exploitation, not the patch itself.
NIS2 Art. 21(2)(d): supply chain security measures	The fix is delivered through Apple's software update channel, and the affected estate is third-party endpoint hardware and OS.	Clients should be able to evidence that endpoint OS update delivery from the vendor is monitored, that unpatched Apple endpoints are visible, and that the update channel itself is treated as a supply chain dependency.

3. Technical analysis & attack chain

CVE-2026-86950 is an out-of-bounds write in CoreGraphics, the Apple framework used across its operating systems and applications to display and process visual content such as images and PDFs. Apple addressed the issue with improved bounds checking. An out-of-bounds write occurs when software writes data beyond the limits of its allocated memory region; the write can overwrite adjacent memory, crash the process, or allow an attacker to take control of the affected process. In this case, processing a maliciously crafted file may lead to arbitrary code execution.

Confirmed steps, as far as the sources support them:

A maliciously crafted file is delivered to a target on an affected Apple device. The sources do not describe the delivery channel; mail, messaging and browser download are all consistent with a file-processing bug, but none is confirmed.
The file is processed by CoreGraphics, which is invoked broadly across the OS and applications when rendering images and PDFs.
The out-of-bounds write is triggered during processing, corrupting memory beyond the allocated region.
The corruption can be shaped into arbitrary code execution in the context of the process handling the file.

That is the extent of the confirmed chain. Apple has not said who was targeted, how many people were affected, who was behind the attacks, or exactly how the vulnerability was being exploited. The Register notes that Apple's wording suggests this was not indiscriminate exploitation and raises the possibility of a targeted spyware campaign, but that is the publication's inference, not a vendor statement.

Affected and fixed versions. The fix is in iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1. Apple lists the devices receiving the iOS and iPadOS update as iPhone 11 and later, iPad Pro 12.9-inch (third generation and later), iPad Pro 11-inch (first generation and later), iPad Air (third generation and later), iPad (eighth generation and later) and iPad mini (fifth generation and later). Apple states the attacks hit devices running versions of iOS before iOS 27, but has not said which older releases were targeted. SANS ISC reports that iOS and macOS 27 are not affected, and that the update to the current 27 branch released the same day does not address security issues. The Register records this as the seventh zero-day Apple has fixed this year.

Reporting and attribution. Meta Product Security reported CVE-2026-86950 to Apple. Neither Apple's advisory nor Meta has provided further technical detail on how the flaw was discovered or the attacks in which it was allegedly used. ANSSI's CERT-FR advisory states that Apple indicates CVE-2026-86950 is actively exploited. No actor is named in any source, and the VERIFIED REFERENCE DATA contains no MITRE ATT&CK profile for this item, so any attribution is unconfirmed. Treat the "extremely sophisticated attack" phrasing as a vendor characterisation of targeting, not as an attribution.

Confidence caveats. The exploitation status rests on Apple's own statement that it is "aware of a report" that the issue may have been exploited; that is a vendor statement, not an independently corroborated observation, and the word "may" is Apple's. The device and version lists are single-sourced to Apple and reproduced by the outlets above. No exploitation tooling, payload, delivery mechanism or post-exploitation behaviour has been published, so there is nothing to characterise beyond the file-processing trigger.

4. Mitigation & containment

P1 (within 24 hours)

Patch all Apple endpoints to iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1 or macOS Tahoe 26.7.1. The KEV remediation due date is 2026-10-02, so treat 24 hours as the internal target and the KEV date as the outer bound. On iOS and iPadOS the path is Settings > General > Software Update; on macOS use Software Update. Enable Automatic Updates on the same screen where it is offered.
Enumerate the estate against Apple's affected device list (iPhone 11 and later; iPad Pro 12.9-inch third generation and later; iPad Pro 11-inch first generation and later; iPad Air third generation and later; iPad eighth generation and later; iPad mini fifth generation and later) and against macOS Sequoia and macOS Tahoe. Devices that cannot be updated to a fixed release need a documented compensating control or removal from the estate.
Identify staff who match a targeted-individual profile (executive, deal team, treasury, legal, M&A, anyone with prior targeting history) and confirm their Apple devices are on a fixed version before anything else. This is where the exploitation risk sits.
If a device is suspected of exploitation, isolate it from the network and preserve it for forensics rather than wiping it. Apple has published no indicators, so triage has to rely on the file-processing trigger and on endpoint telemetry, not on a signature.

P2 (within 72 hours)

Restrict or monitor the automatic opening of image and PDF attachments in mail and messaging clients on Apple endpoints until the estate is fully patched. This does not remove the flaw but reduces the number of paths by which a crafted file reaches CoreGraphics without user action.
Review endpoint detection coverage for process activity originating from image and PDF rendering paths on macOS, and for crashes in processes that handle untrusted files. A crash in a rendering process on a targeted individual's device is worth investigating rather than closing.
Confirm that the update channel itself is monitored: an endpoint that reports itself as current but has not received the 26.7.1 / 15.8.1 / 26.7.1 builds is a gap, not a pass.

P3 (within 7 days)

Fold the Apple endpoint estate into the routine patch-compliance reporting so that future zero-days of this type can be scoped without a manual sweep.
Where clients operate under DORA, confirm that the incident-management and reporting path in §2 has been exercised for an endpoint-compromise scenario, since the trigger for reporting is a confirmed exploitation and not the patch.

5. Indicators of compromise

No indicators of compromise available in the source material.

The sources describe no hashes, domains, IP addresses, file paths, registry keys or filenames. Apple has published no technical detail on the exploitation, and no vendor has published atomic indicators. The only observable behaviour described is the processing of a maliciously crafted file by CoreGraphics, which is not specific enough to pivot on.

Behavioural indicators

behaviour	where to observe	confidence
Crash or abnormal termination in a process that renders images or PDFs, on a device running iOS before iOS 27 or an unpatched macOS Sequoia or macOS Tahoe build	Endpoint crash and diagnostic telemetry on macOS; device analytics on iOS and iPadOS	Low. Derived from the vulnerability class and the file-processing trigger, not from published exploitation telemetry.
Unexpected code execution in the context of a process handling an untrusted image or PDF	EDR process telemetry on macOS	Low. Same basis; no published post-exploitation behaviour exists to match against.

6. Detection

Insufficient indicators to author detection rules.

The sources contain no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text or hard-coded values. The only named artefacts are the CVE identifier, the CoreGraphics framework name and the affected product versions, none of which are artefacts of the threat itself. A rule built from those would detect reporting about the vulnerability, not exploitation of it. Detection effort should go to the behavioural observations in §5 and to patch-state verification instead.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

CVE	CVSS	Exploited	EPSS	Summary
CVE-2026-86950	8.8 High	⚠ KEV 2026-09-29	1%	An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1,…

7. Sources

NVD, CVE-2026-86950 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-86950, published 2026-09-28.
The Hacker News, "Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks", https://thehackernews.com/2026/09/apple-patches-coregraphics-flaw.html, 2026-09.
Malwarebytes Labs, "Update your iPhone, iPad, or Mac: Flaw could run attackers' code", https://www.malwarebytes.com/blog/bugs/2026/09/update-your-iphone-ipad-or-mac-flaw-could-run-attackers-code, 2026-09.
ANSSI CERT-FR, "Vulnérabilité dans les produits Apple", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1236/, 2026-09-29.
The Register, "Apple patches CoreGraphics zero-day already exploited in targeted attacks", https://www.theregister.com/security/2026/09/29/apple-patches-coregraphics-zero-day-already-exploited-in-targeted-attacks/5299721, 2026-09-29.
SANS Internet Storm Center, "Apple Emergency Patch for iOS 26/macOS26/macOS15 (CVE-2026-86950)", https://isc.sans.edu/diary/rss/33376, 2026-09-28.
Help Net Security, "Apple squashes zero-day bug exploited in 'extremely sophisticated' attack (CVE-2026-86950)", https://www.helpnetsecurity.com/2026/09/29/apple-core-graphics-zero-day-cve-2026-86950-fixed/, 2026-09-29.

8. Adverse Trace position

Adverse Trace assesses CVE-2026-86950 as CVSS 8.8 (HIGH) with confirmed CISA KEV listing as of 2026-09-29 and an EPSS of 1%, and we treat the exploitation as real but narrow: Apple's own wording limits it to specific targeted individuals on iOS before iOS 27, and no actor, payload or delivery mechanism has been published, so we do not attribute this to any group and we do not treat it as mass exploitation. The client impact is concentrated in a small number of high-value staff on unpatched Apple endpoints, and the KEV due date of 2026-10-02 makes this a same-week remediation item rather than a routine patch cycle. We will track Apple's advisory for any technical detail on the exploitation, watch for the first published indicators or post-exploitation behaviour, and reissue this advisory if attribution or tooling emerges. Clients who cannot confirm patch state across their Apple estate should contact us before the KEV due date.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.