Apple Multiple Products Out-of-Bounds Write Vulnerability (CVE-2026-86950)

What is affected, what to do

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1.

The vulnerability is being actively exploited; treat it as a priority. Update Apple iOS and iPadOS to version 26.7.1, Apple macOS to version 15.8.1, Apple macOS to version 26.7.1. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Apple iOS and iPadOS lt *..26.7.1
• Apple macOS lt *..15.8.1
• Apple macOS lt *..26.7.1

Fixed in

• Apple iOS and iPadOS 26.7.1
• Apple macOS 15.8.1
• Apple macOS 26.7.1

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Push updates now: Update iOS and iPadOS to 26.7.1, macOS Tahoe to 26.7.1 and macOS Sequoia to 15.8.1 (or later). Enforce this via MDM (Jamf, Intune, Kandji, Workspace ONE) with a short deadline (≤ 24 h) and a forced restart. Waiting for the regular patch window is not appropriate.
   • High-risk users first: Prioritise executives, board members, control-room and OT leads, administrators, communications staff and anyone travelling to high-risk regions. Apple describes targeted attacks against specific individuals. Track these devices personally rather than relying only on MDM reports.
   • Inventory unpatched devices: Filter the MDM export by OS version and put every device below the fixed releases on an exceptions list. Include BYOD devices, shared or control-room iPads, kiosk-mode devices and unmanaged contractor Macs.
   • Tighten conditional access: Block non-compliant devices (OS below the fixed versions) from mail, Teams/Slack, VPN and SSO. For example, set the Intune compliance policy "Minimum OS version" to 26.7.1 (iOS/iPadOS) and 15.8.1/26.7.1 (macOS).
   • Enable Lockdown Mode: Turn on Lockdown Mode for high-risk users until the update is confirmed, and ideally keep it on permanently. It significantly reduces attack surface for attachments, image previews and link previews.
2. 02

   Runbook step 2

   Mitigation layers

   • Mail and content filtering: CoreGraphics parses PDF and image formats. At the mail gateway, route external PDFs and unusual image types (e.g. TIFF, PDFs containing JBIG2, HEIC, PSD) to sandbox detonation or quarantine. Apply CDR (content disarm and reconstruction) to high-risk mailboxes.
   • Messaging and proximity attack surface: Use MDM profiles to set AirDrop to "Contacts Only" or "Off". Train users not to open iMessage attachments from unknown senders. For high-risk users who cannot run Lockdown Mode, temporarily disable iMessage and FaceTime.
   • Network segmentation: Place mobile endpoints in a dedicated Wi-Fi/VPN segment with no direct route to OT, control-room or admin networks. Allow administrative access from iPads and Macs only through MFA-protected jump hosts.
   • macOS endpoint hardening: Enforce Gatekeeper, SIP and XProtect as compliance checks in MDM. Remove local admin rights so that user-context code execution does not immediately translate into system-level persistence.
   • IAM / least privilege: Revoke sessions and app passwords for any device under suspicion (e.g. Entra ID "Revoke sessions"). Shorten refresh-token lifetimes for mobile devices until the rollout is complete.
3. 03

   Runbook step 3

   Detection rules

   • Patch compliance (Defender for Endpoint / Intune): DeviceInfo | where OSPlatform == "macOS" | summarize arg_max(Timestamp,*) by DeviceId | where parse_version(OSVersion) < parse_version("15.8.1") or (parse_version(OSVersion) >= parse_version("26.0") and parse_version(OSVersion) < parse_version("26.7.1")). Do the same for iOS/iPadOS via the Intune device export with a 26.7.1 threshold.
   • Crash reports (macOS): Search /Library/Logs/DiagnosticReports and ~/Library/Logs/DiagnosticReports for crashes of Preview, QuickLookUIService, Mail, Messages/BlastDoor or Safari where the crashed thread contains CoreGraphics frames. A cluster of such crashes shortly after receiving external files is a strong signal. Query the unified log with log show --predicate 'process == "ReportCrash"' --last 7d.
   • Process ancestry (EDR, Sigma shape): Build a process_creation rule with ParentImage|endswith in (/Preview, /QuickLookUIService, /Mail, /Safari) and Image|endswith in (/sh, /bash, /zsh, /osascript, /curl, /python3). This chain is highly anomalous on macOS.
   • iOS forensics: For high-risk users' devices, capture a local backup or sysdiagnose and scan it with the Mobile Verification Toolkit (MVT) against published IOC sets once research on this campaign becomes available. Look for unexpected processes, abnormal data usage and reboot anomalies.
   • Network telemetry (Zeek/Suricata/proxy): Correlate first-seen connections from managed Apple devices to rare or newly registered domains shortly after attachment delivery. Treat low-prevalence DNS queries from the mobile segment as hunting leads.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

Source: NVD (NIST), CISA KEV Catalog, cvelistv5, CVE.org (MITRE), BSI CSAF, BSI WID Portal

References & sources

• support.apple.comen-us/149226
• support.apple.comen-us/149228
• support.apple.comen-us/149229
• seclists.orgfulldisclosure/2026/Sep/89
• seclists.orgfulldisclosure/2026/Sep/90
• seclists.orgfulldisclosure/2026/Sep/91
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86950government-resource

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

1. CVE CISA KEV Update08.10.20269119a7d8-5eab-497f-8521-727c672e3725

   • Due Date: before 2026-09-29 after 2026-09-29

2. CVE Modified01.10.2026134c704f-9b21-4f2e-91b3-4a467353bcc0

   • SSVC: before {"id":"CVE-2026-86950","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technica…
   • SSVC: after {"id":"CVE-2026-86950","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technica…

3. CVE Modified30.09.2026134c704f-9b21-4f2e-91b3-4a467353bcc0

   • SSVC: before {"id":"CVE-2026-86950","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technica…
   • SSVC: after {"id":"CVE-2026-86950","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technica…

4. Initial Analysis29.09.2026nvd@nist.gov

   • CPE Configuration: after OR *cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* versions up to (excluding) 26.7.1 *cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* versions up to (excluding) 15.8.1 *cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* versions up to (excluding) 26.7.1 *cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* versions from (including) 26.0 up to (excluding) 26.7.1
   • Reference Type: after Apple Inc.: https://support.apple.com/en-us/149226 Types: Release Notes, Vendor Advisory
   • Reference Type: after Apple Inc.: https://support.apple.com/en-us/149228 Types: Release Notes, Vendor Advisory
   • Reference Type: after CVE: http://seclists.org/fulldisclosure/2026/Sep/89 Types: Mailing List, Third Party Advisory

5. CVE CISA KEV Update29.09.20269119a7d8-5eab-497f-8521-727c672e3725

   • Date Added: after 2026-09-29
   • Due Date: after 2026-09-29
   • Required Action: after 2026-09-29
   • Vulnerability Name: after 2026-09-29

Linked advisories

• Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery PathThe Hacker News01.10.2026
• Apple Zero-Day Vulnerability Weaponized in Targeted AttacksDark Reading29.09.2026
• Apple Patches Zero-Day Linked to ‘Extremely Sophisticated Attack’SecurityWeek29.09.2026
• Vulnérabilité dans les produits Apple (29 septembre 2026)CERT-FR (ANSSI)29.09.2026
• Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th)SANS ISC Diary28.09.2026
• Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted AttacksThe Hacker News28.09.2026