CVE-2026-86950: presente nel catalogo CISA KEV

CVE-2026-86950 · CVSS 8.8 HIGH · KEV 2026-09-29 · patch disponibile

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

CVE-2026-86950 viene sfruttato?

• Inserito nel catalogo CISA KEV il 2026-09-29.
• Scadenza di remediation federale: 2026-10-02.
• Codice di exploit pubblico: nessuno trovato nelle fonti monitorate.

Quali prodotti e versioni sono interessati?

• Apple · iOS · <26.7.1
• Apple · macOS · Sequoia <15.8.1
• Apple · macOS · Tahoe <26.7.1
• Apple · iPadOS · <26.7.1
• Apple · iOS and iPadOS · >= 0, < 26.7.1
• Apple · macOS · >= 0, < 15.8.1, >= 0, < 26.7.1

Esiste una patch?

• iOS 26.7.1
• macOS Sequoia 15.8.1
• macOS Tahoe 26.7.1
• iPadOS 26.7.1

Cosa ha pubblicato PlainSec su CVE-2026-86950

• Apple CoreGraphics Zero-Day Is Now in the Wild (2026-09-28)

Fonti primarie

• NVD record
• CISA KEV catalog

Cosa questa scheda non dice

• Nessun punteggio EPSS.

KEV ed EPSS vengono ricontrollati ogni giorno. Scheda aggiornata il 2026-09-29.