Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhighExploited in the wild

Apple Security Advisory AV26-1099 Addresses CVE-2026-86950

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Apple released iOS 18.7.11 backport and other updates for CVE-2026-86950, which may have been used in targeted attacks.

Apple released security updates on October 26, 2026, including a backport of the CoreGraphics out-of-bounds write fix CVE-2026-86950 for older iOS devices. The flaw may have been exploited in sophisticated targeted attacks on users of iOS before version 27, according to Apple. The Canadian Centre for Cyber Security issued advisory AV26-1099 on October 28, 2026, listing affected versions across multiple platforms. Users should apply the latest updates from Apple's security releases page.

Key facts
  • CVE-2026-86950: out-of-bounds write in CoreGraphics
  • Backported to iOS 18.7.11 for older iPhones/iPads
  • First fixed in iOS 26.7.1
  • Affects iOS/iPadOS before 18.7.11, 26.7.2, 27.2
  • macOS before 27.2, 26.7.2, 15.8.2
  • Targeted attacks reported before iOS 27
Analyze CVE-2026-86950 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 26, 2026Apple releases security updates with iOS 18.7.11 backport for CVE-2026-86950 · Malwarebytes Labs
  2. Oct 28, 2026Canadian Centre issues Apple security advisory AV26-1099 · Canadian Centre for Cyber Security
  3. Oct 29, 2026Malwarebytes reports on iOS security update and targeted attacks · Malwarebytes Labs

What each outlet adds

beyond the shared facts
  • Canadian Centre for Cyber SecurityIssued AV26-1099 listing affected versions for iOS, macOS, visionOS and others
  • Malwarebytes LabsDetails CVE-2026-86950, targeted attacks and iOS 18.7.11 backport for specific devices
CVEs
CVE-2026-86950
Vendors
Apple
Products
iOSiPadOSCoreGraphicsmacOSvisionOStvOSwatchOSSafari
Organizations
Canadian Centre for Cyber Security

Coverage

oldest first · one row per article · UTC
  1. · 6d ago Canadian Centre for Cyber SecurityFirst report

    Apple advisory AV26-1099 lists flaws in iOS, macOS, Safari and more

    Affected builds are those before the stated iOS, iPadOS, macOS, visionOS, tvOS, watchOS and Safari releases.

  2. · 5d ago Malwarebytes Labs

    Apple fixes CoreGraphics flaw CVE-2026-86950 on older iPhones and iPads

    Apple says the out-of-bounds write may have been used in targeted attacks on iOS before iOS 27; iOS 18.7.11 backports the fix.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-86950
Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS
8.826%KEVPoC ×3
KEV