highclosedpatched
Apple CoreGraphics zero-day CVE-2026-86950
› Apple iOS, iPadOS, macOS (CoreGraphics)
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Sep 29, 2026
- closed
- Sep 29, 2026
- CVEs
- 1
- sources
- 2
## summary
Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that may lead to arbitrary code execution, and indicated it may have been exploited in a sophisticated targeted attack against earlier iOS versions. Fixed in iOS/iPadOS 26.7.1 and corresponding macOS updates. CISA added to KEV Sept 29.
severity: Actively exploited / CISA KEV
## cve ids[1]
## affected
- Before iOS/iPadOS 26.7.1 and matching macOS security updates
## fixed in
- iOS/iPadOS 26.7.1
- macOS security updates per Apple HT149226/149228/149229
## advisories[1]
## news & write-ups[1]
## notes & caveats
Verify primary vendor advisory for exact fixed versions; facts taken from public sources listed in links.
