Apple patches CoreGraphics flaw CVE-2026-86950 after targeted-attack reports
First coverage.
Apple patched CoreGraphics out-of-bounds write CVE-2026-86950, which it says may have been exploited in sophisticated targeted attacks, and CISA set a federal deadline of October 2, 2026.
Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that can lead to arbitrary code execution when a maliciously crafted file is processed. The company said it may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27; Dark Reading described exploitation as ongoing, while most outlets retained Apple's "may have been" wording. Fixes are in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 and are credited to Meta Product Security. TechCrunch instead called it a graphics-engine bug that could expose personal data, said roughly four in five iPhones still run iOS 26, and said the 27 releases are unaffected. CISA later added the flaw, scored CVSS 8.8, to its Known Exploited Vulnerabilities catalog with a federal deadline of October 2, 2026, after a September 29 report said it was not yet listed. Researchers then published a crash-only proof of concept that does not show code execution; reports disagree on whether WhatsApp was involved, and Apple has not confirmed delivery. TechCrunch also described a separate zero-click bug, CVE-2026-86869, fixed in the 27 releases, that could be triggered by a malicious iMessage and bypass BlastDoor, with pre-fix exploitation unconfirmed.
- CVE-2026-86950 is an out-of-bounds write in Apple CoreGraphics (TechCrunch: the graphics engine), scored CVSS 8.8 in the CISA report, that can allow arbitrary code execution when a crafted file is processed.
- Apple said the flaw may have been exploited in an extremely sophisticated attack against specific people on iOS before iOS 27; Dark Reading instead said attackers are exploiting it.
- Fixes are iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1; The Hacker News said Apple patched it on September 28, 2026. Affected devices include iPhone 11 and later and listed recent iPads.
- Meta Product Security discovered and reported CVE-2026-86950. Apple has not confirmed targets, threat actors, or how malicious files were delivered.
- CISA added the CVE to its Known Exploited Vulnerabilities catalog and ordered U.S. federal agencies to remediate by October 2, 2026. A September 29 report said it was not yet listed.
- TechCrunch said about four in five iPhones still run iOS 26 and that iOS 27, iPadOS 27, and macOS 27 are unaffected.
- A crash-only public proof of concept was published around September 30 and does not demonstrate code execution. Sources disagree on a WhatsApp delivery path.
- TechCrunch also reported separate zero-click CVE-2026-86869, fixed in the 27 releases, as an iMessage issue that could bypass BlastDoor, with use before the fix unconfirmed. The Register called CVE-2026-86950 Apple's seventh zero-day fix…
Coverage
oldest first · one row per article · UTC- · Sep 29, 2026
TechCrunch · SecurityFirst report
Still running iOS 26? Update your iPhones, iPads and Macs for this urgent security fix
Apple patched graphics-engine CVE-2026-86950 in iOS 26 after possible targeted exploitation.
- · Sep 29, 2026
Security Affairs
Apple Patches CoreGraphics Zero-Day Linked to Sophisticated Targeted Attacks
Apple patched CoreGraphics zero-day CVE-2026-86950 (out-of-bounds write enabling arbitrary code execution) reportedly exploited in sophisticated targeted attacks on iOS users.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-24200 | Incorrect Authorization in Apple iOS/iPadOS Lets Attackers Disable USB Restricted Mode | 6.1 | 4% | KEV | KEV |
| CVE-2025-43300 | Actively Exploited Out-of-Bounds Write in Apple iOS/iPadOS/macOS Image I/O | 10.0 | 65% | KEVPoC | KEV |
| CVE-2025-55177 | Incorrect Authorization in WhatsApp Linked-Device Sync Used in Targeted Spyware Attacks | 5.4 | 14% | KEV | KEV |
| CVE-2026-20700 | Exploited Memory Corruption Flaw in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS | 7.8 | 2% | KEV | KEV |
| CVE-2026-65400 | Authentication Bypass in Apple macOS Screen Sharing | 9.8 | 2% | KEV | KEV |
| CVE-2026-86869 | Out-of-bounds write in Apple image handling crashes apps | 6.5 | — | ||
| CVE-2026-86950 | Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS | 8.8 | 26% | KEVPoC ×3 | KEV |