CVE-2026-86950: listed in the CISA KEV catalog

CVE-2026-86950 · CVSS 8.8 HIGH · KEV 2026-09-29 · patch available

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

Is CVE-2026-86950 exploited?

• Listed in the CISA KEV catalog on 2026-09-29.
• Federal remediation due 2026-10-02.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Apple · iOS · <26.7.1
• Apple · macOS · Sequoia <15.8.1
• Apple · macOS · Tahoe <26.7.1
• Apple · iPadOS · <26.7.1
• Apple · iOS and iPadOS · >= 0, < 26.7.1
• Apple · macOS · >= 0, < 15.8.1, >= 0, < 26.7.1

Is there a patch?

• iOS 26.7.1
• macOS Sequoia 15.8.1
• macOS Tahoe 26.7.1
• iPadOS 26.7.1

What PlainSec published about CVE-2026-86950

• Apple CoreGraphics Zero-Day Is Now in the Wild (2026-09-28)

Primary sources

• NVD record
• CISA KEV catalog

What this record does not say

• No EPSS score.

KEV and EPSS are re-checked daily. Record last updated 2026-09-29.