Apple patches CVE-2026-86950 zero-day vulnerability used in targeted attacks

Apple has released security updates for iPhone, iPad and Mac users after disclosing a serious vulnerability that could allow attackers to execute arbitrary code on affected devices.

The vulnerability, tracked as CVE-2026-86950, affects Apple’s CoreGraphics framework and is caused by an out-of-bounds write. Apple says the problem has been fixed with improved bounds checking.

More significantly, Apple has acknowledged that it is aware of a report suggesting the vulnerability may have been exploited in an extremely sophisticated attack against specific targeted individuals.

What is CVE-2026-86950?

CVE-2026-86950 is a memory-safety vulnerability affecting CoreGraphics, a fundamental component of Apple’s operating systems responsible for processing and displaying graphical content.

Apple describes the problem as an “out-of-bounds write” vulnerability.

An out-of-bounds write occurs when software attempts to write data outside the memory area allocated for a particular operation. Depending on how the vulnerability can be exploited, this can result in a crash, memory corruption or potentially the execution of attacker-controlled code.

In the case of CVE-2026-86950, Apple says processing a maliciously crafted file could result in arbitrary code execution.

This means an attacker could potentially prepare a specially crafted file designed to trigger the vulnerability when it is processed by a vulnerable device.

The vulnerability has been assigned a CVSS 3.1 score of 8.8, placing it in the High severity category. The scoring indicates that exploitation can potentially have a major impact on the confidentiality, integrity and availability of an affected system.

Apple says attacks may already have taken place

One of the most important aspects of CVE-2026-86950 is Apple’s statement regarding potential exploitation.

Apple says it is aware of a report that the vulnerability may have been exploited in an extremely sophisticated attack against specific targeted individuals using versions of iOS before iOS 27.

Apple has not disclosed how many people may have been targeted, who was responsible for the attacks or exactly how the vulnerability was delivered.

There is also no public information from Apple confirming the complete attack chain or explaining how the malicious file reached the targeted devices.

Security researchers have noted that the lack of technical details makes it difficult to determine the precise exploitation method at this stage. The available information does, however, establish that Apple considers the vulnerability sufficiently serious to disclose possible exploitation alongside the security update.

CoreGraphics is an important part of Apple’s operating systems

CoreGraphics is used throughout Apple’s software platforms to handle graphics and related content.

Because the framework is integrated into the operating system, a vulnerability in CoreGraphics can have consequences beyond a single application.

The affected vulnerability can be triggered when a maliciously crafted file is processed. Apple therefore recommends installing the appropriate security update rather than relying on application-level protections.

The vulnerability was reported to Apple by Meta Product Security.

Which Apple devices are affected?

Apple has released fixes for several operating system branches.

For iPhone and iPad, the vulnerability is fixed in:

• iOS 26.7.1
• iPadOS 26.7.1

The iOS and iPadOS security update applies to iPhone 11 and later, along with supported iPad Pro, iPad Air, iPad and iPad mini models.

For Mac computers, Apple has released:

• macOS Tahoe 26.7.1
• macOS Sequoia 15.8.1

Apple’s security documentation identifies CVE-2026-86950 as the CoreGraphics vulnerability addressed by these releases.

The CVE record identifies iOS and iPadOS versions before 26.7.1 as affected, while macOS versions before Sequoia 15.8.1 and Tahoe 26.7.1 are listed as affected.

Why an out-of-bounds write can be dangerous

Memory corruption vulnerabilities have historically been an important component of sophisticated attacks because they can sometimes be combined with other vulnerabilities to bypass security protections.

An out-of-bounds write essentially means that software has failed to properly restrict where data can be written in memory.

An attacker attempting to exploit such a vulnerability may try to manipulate the memory layout of the affected process and turn the memory corruption into controlled execution.

The CVE-2026-86950 description specifically states that processing a maliciously crafted file can lead to arbitrary code execution.

The CVSS assessment gives the vulnerability a network attack vector, requires user interaction and does not require the attacker to have existing privileges on the affected system.

The requirement for user interaction is an important distinction, although the precise method by which the attacks referenced by Apple worked has not been publicly disclosed.

A targeted attack rather than evidence of widespread exploitation

Apple’s wording is also important.

The company has not said that CVE-2026-86950 has been used in a widespread campaign against ordinary users.

Instead, Apple refers to a report involving “specific targeted individuals” and describes the attack as extremely sophisticated.

Security reporting following the disclosure has similarly noted that Apple has not provided details about the number of victims, the attacker or the delivery mechanism.

This means that while there is an indication of possible exploitation, the currently available information does not establish the scale of any campaign.

What should Apple users do?

Users running affected versions of Apple’s operating systems should install the relevant security update.

For supported iPhones, this means updating to iOS 26.7.1 or later.

For supported iPads, install iPadOS 26.7.1 or later.

Mac users running macOS Tahoe should install version 26.7.1, while users running macOS Sequoia should install version 15.8.1 or later.

Apple released all of these security updates on 28 September 2026.

Users should also be cautious about opening unexpected files received through email, messaging services or other communication platforms, particularly while running an operating system version that has not received the security fix.

CVE-2026-86950 highlights the continuing threat from memory vulnerabilities

CVE-2026-86950 demonstrates why operating-system security updates remain important even when a vulnerability may only be used against a relatively small number of targeted victims.

The flaw itself is relatively technical — an out-of-bounds write in CoreGraphics — but its potential impact is much more serious because specially crafted files can potentially turn the memory corruption into arbitrary code execution.

Apple’s disclosure that the vulnerability may have already been used in attacks makes the availability of the patches particularly significant.

At present, Apple has not publicly identified the attackers, disclosed the complete attack chain or provided details about the reported victims.

What is known is that the vulnerability affects older versions of iOS, iPadOS and macOS, has a CVSS score of 8.8, and has been addressed through Apple’s latest security updates.

For Apple users, keeping supported devices fully updated remains the primary protection against CVE-2026-86950.