Apple Patches CoreGraphics Zero Day Exploited in Attacks
Apple patched CVE-2026-86950, a CoreGraphics zero-day reportedly exploited against targeted iOS users.
84
Vulnerability3 · 1 read
CVE-2026-86869
Out-of-bounds write in Apple image handling crashes apps
- CVSS 3.1
- 6.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-86869 is an out-of-bounds write (CWE-787) in Apple image processing that Apple fixed with improved bounds checking. It is triggered when a person processes a maliciously crafted image; the attack is network-reachable with low complexity, needs no privileges, and requires user interaction. Apple reports the result as unexpected app termination, matching a CVSS 3.1 score of 6.5 with high availability impact and no confidentiality or integrity impact. iPhones, iPads, and Macs running releases before iOS 26.7, iPadOS 26.7, and macOS Golden Gate 27 are affected. There is no known public proof of concept, and the issue is not in CISA's Known Exploited Vulnerabilities catalog.
What to do: Update iPhones and iPads to iOS 26.7 or iPadOS 26.7 and Macs to macOS Golden Gate 27. Until those releases are installed, do not open or process image files from unknown or untrusted sources, because the bug is reached only when a crafted image is processed.
| Product | Affected |
|---|---|
| Apple iOS | versions before 26.7 |
| Apple iPadOS | versions before 26.7 |
| Apple macOS | versions before Golden Gate 27 |
Estimated exposure
masshundreds of millions of iPhone, iPad, and Mac devices (unpatched installs only) — Apple's combined active base of iPhones, iPads, and Macs is publicly reported in the hundreds of millions to over a billion devices, and image processing is part of the core OS, so unpatched installs are a mass population; only devices…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Golden Gate 27. Processing a maliciously crafted image may lead to unexpected app termination.
- Vendors
- apple
- Products
- ipados, iphone os, macos
- Weakness
- CWE-787
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
In the news
2 storiesStill running iOS 26? Update your iPhones, iPads and Macs for this urgent security fix
Apple patched graphics-engine CVE-2026-86950 in iOS 26 after possible targeted exploitation.
82