Apple CoreGraphics Out-of-Bounds Write (CVE-2026-86950)

Catalog analysis: CISA added this entry on September 29, 2026. The entry reflects catalog information retrieved on September 29, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-86950 is an out-of-bounds write vulnerability (CWE-787) located within the CoreGraphics component of Apple’s operating systems. This flaw could potentially allow an attacker to achieve arbitrary code execution on the affected system.

Exposure and applicability

This vulnerability affects multiple Apple product lines, specifically:
* iOS
* macOS
* iPadOS

Because this resides in CoreGraphics—a framework used for rendering and image processing—exposure is tied to the handling of malformed graphical data. The risk is elevated by its inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog as of September 29, 2026, indicating that the vulnerability has been observed in active exploitation.

Remediation priorities

Our analysis suggests prioritizing remediation based on asset exposure and the criticality of the device. The following actions are recommended:

1. Immediate Patch Deployment: Prioritize updating iOS, macOS, and iPadOS devices to the versions specified in Apple’s vendor instructions. This is the primary method for addressing the underlying out-of-bounds write.
2. Exposure Assessment: Identify internet-facing assets or devices that process untrusted graphical content from external sources, as these represent a higher immediate risk of exploitation.
3. Forensic Triage: For organizations within high-risk sectors, we recommend performing forensic triage on critical systems to determine if the vulnerability was exploited prior to patching, in alignment with CISA’s Forensics Triage Requirements.

How to validate remediation

Verification must move beyond simple version checks. To ensure exposure is reduced, defenders should:
* Confirm Patch Application: Verify that the specific security updates addressing CVE-2026-86950 have been successfully installed and initialized across the fleet via mobile device management (MDM) or system reports.
* Configuration Audit: Ensure that devices are configured to receive automatic updates to reduce the window of exposure for future iterations of similar flaws.

It is important to note that a version number alone does not prove the absence of an exploit if the system was compromised prior to the update; therefore, validation should be paired with the aforementioned forensic triage for high-value assets.

Limits and open questions

While vendor mitigations are available, there are remaining uncertainties. It is currently unknown whether this vulnerability has been utilized in known ransomware campaigns. Additionally, while patching reduces the likelihood of exploitation, residual risk remains if attackers have already established persistence on a system via this or other vulnerabilities before the patch was applied.

Source and editorial note

CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability · Source date: September 29, 2026 · Retrieved September 29, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment