AppYour homeOperatorJournalAlerts
Request an introduction
Security issueApple

CVE-2026-86950

A memory flaw in Apple's graphics code that lets a booby-trapped file run code. Apple fixed it on 28 Sep 2026. It’s being used in attacks.

CVE-2026-86950CoreGraphics
Attacks
Used in attacksOn CISA's list of flaws used in attacks since 29 Sep 2026. Every Apple flaw on the list
Affected
  • iOS and iPadOS before 26.7.1
  • macOS Tahoe before 26.7.1
  • macOS Sequoia before 15.8.1
Fixed in
iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1
Severity
Apple doesn’t rate severity. CVSS 8.8 out of 10 (high), scored by CISA.
Official name
Apple Multiple Products Out-of-Bounds Write Vulnerability
What's known.From Apple’s security notes, CISA's catalogue of exploited flaws and NVD, checked 23 Oct 2026.

What it is

CoreGraphics is the code macOS, iOS and iPadOS use to draw graphics. This flaw is an out-of-bounds write: a maliciously crafted file can make CoreGraphics write past the end of the memory it was given, and Apple says processing such a file may lead to arbitrary code execution.

Apple's report of attacks is about iPhones: versions of iOS before iOS 27. The same flaw is in macOS, and Apple fixed it there on the same day.

Is it being used in attacks?

Yes. In its note for iOS 26.7.1 and iPadOS 26.7.1, Apple says: “Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.”

CISA, the US cybersecurity agency, added it to its catalogue of known exploited vulnerabilities on 29 Sep 2026, the day after the fix. CISA lists a flaw only when it has reliable evidence of it being exploited, and gave US federal agencies until 13 Oct 2026 to fix it.

Apple hasn’t said more than that, and CISA doesn’t say who was attacked or how.

What to do

  1. Update macOS, then restart.System Settings → General → Software Update. Tahoe needs 26.7.1 and Sequoia needs 15.8.1, or later.
  2. Update iPhones and iPads too.Settings → General → Software Update.

Advisories that include it

  1. macOS Sequoia before 15.8.1

Sources

  1. About the security content of iOS 26.7.1 and iPadOS 26.7.1The fix, and Apple’s statement about attacks.support.apple.com ·
  2. About the security content of macOS Tahoe 26.7.1The fix, and what Apple says it does.support.apple.com ·
  3. About the security content of macOS Sequoia 15.8.1The fix, and what Apple says it does.support.apple.com ·
  4. Known Exploited Vulnerabilities catalog: CVE-2026-86950Added 29 Sep 2026: CISA has evidence it is being used in attacks.cisa.gov ·
  5. CVE-2026-86950The official description, and a CVSS score of 8.8 out of 10 from CISA.nvd.nist.gov ·
Every advisoryLook up any app, company or CVEThe HARD Mac app links its warnings here.