CVE-2026-86950
HIGH CISA KEV
ACT NOW
Priority: 2.30
BB Relevance:
73/100
Published: 2026-09-28
Modified: 2026-10-27
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Required
S:
Unchanged
C:
High
I:
High
A:
High
Description
Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
CISA Known Exploited Vulnerability
Vendor / Product
Apple — Multiple Products
Date Added
2026-09-29
Remediation Due
2026-10-13
https://support.apple.com/en-us/149226 ; https://support.apple.com/en-us/149228 ; https://support.apple.com/en-us/149229 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-86950
Weakness Classification (1)
Affected Software (12)
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 18.7.11 |
| apple | ipados | 26.0 – 26.7.1 |
| apple | ipados | < 18.7.11 |
| apple | ipados | 26.0 – 26.7.1 |
| apple | iphone_os | < 18.7.11 |
| apple | iphone_os | 26.0 – 26.7.1 |
| apple | iphone_os | < 18.7.11 |
| apple | iphone_os | 26.0 – 26.7.1 |
| apple | macos | < 15.8.1 |
| apple | macos | 26.0 – 26.7.1 |
| apple | macos | < 15.8.1 |
| apple | macos | 26.0 – 26.7.1 |
References & Advisories (8)
US Government Resource
Release Notes
Vendor Advisory
Release Notes
Vendor Advisory
Release Notes
Vendor Advisory
Release Notes
Vendor Advisory
Mailing List
Third Party Advisory
Mailing List
Third Party Advisory
Mailing List
Third Party Advisory