# CVE-2026-86950

CoreGraphics out-of-bounds write in Apple OSes enabling arbitrary code execution via crafted files.

- Page: https://www.vulneraibility.com/cve/CVE-2026-86950
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2026-09-29; CISA due date 2026-10-13
- EPSS: 26.17% (percentile 98.0)
- Unvetted proof-of-concept code on GitHub: 7 GitHub proofs of concept (first 2026-09-29)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2026-09-30)
- Weakness: CWE-787
- Published: 2026-09-28

## Affected versions

- Apple iOS and iPadOS: affected < 26.7.1
- Apple macOS: affected < 15.8.1; < 26.7.1

A version outside these ranges is not a statement that it is unaffected.

## Impact

Processing a malicious file can trigger arbitrary code execution, allowing attackers to run code, compromise devices, and exfiltrate data.

## Action

Immediate action required

## Recommendation

Install Apple updates immediately; isolate/scan suspected devices and follow CISA BOD 26-04 guidance.

## References

- [other] https://support.apple.com/en-us/149225
- [other] https://support.apple.com/en-us/149226
- [other] https://support.apple.com/en-us/149228
- [other] https://support.apple.com/en-us/149229
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86950
- [other] http://seclists.org/fulldisclosure/2026/Sep/89
- [other] http://seclists.org/fulldisclosure/2026/Sep/90
- [other] http://seclists.org/fulldisclosure/2026/Sep/91

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.