FreeBSD: Out-of-bounds Write (CVE-2026-86950)

What is affected, what to do

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1.

The vulnerability is being actively exploited; treat it as a priority. Update Apple iOS and iPadOS to version 18.7.11, Apple iOS and iPadOS to version 26.7.1, Apple macOS to version 15.8.1. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Apple iOS and iPadOS lt *..18.7.11
• Apple iOS and iPadOS lt *..26.7.1
• Apple macOS lt *..15.8.1
• Apple macOS lt *..26.7.1

Fixed in

• Apple iOS and iPadOS 18.7.11
• Apple iOS and iPadOS 26.7.1
• Apple macOS 15.8.1
• Apple macOS 26.7.1

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Push updates now: Update iOS and iPadOS to 26.7.1, macOS Tahoe to 26.7.1 and macOS Sequoia to 15.8.1 (or later). Enforce this via MDM (Jamf, Intune, Kandji, Workspace ONE) with a short deadline (≤ 24 h) and a forced restart. Waiting for the regular patch window is not appropriate.
   • High-risk users first: Prioritise executives, board members, control-room and OT leads, administrators, communications staff and anyone travelling to high-risk regions. Apple describes targeted attacks against specific individuals. Track these devices personally rather than relying only on MDM reports.
   • Inventory unpatched devices: Filter the MDM export by OS version and put every device below the fixed releases on an exceptions list. Include BYOD devices, shared or control-room iPads, kiosk-mode devices and unmanaged contractor Macs.
   • Tighten conditional access: Block non-compliant devices (OS below the fixed versions) from mail, Teams/Slack, VPN and SSO. For example, set the Intune compliance policy "Minimum OS version" to 26.7.1 (iOS/iPadOS) and 15.8.1/26.7.1 (macOS).
   • Enable Lockdown Mode: Turn on Lockdown Mode for high-risk users until the update is confirmed, and ideally keep it on permanently. It significantly reduces attack surface for attachments, image previews and link previews.
2. 02

   Runbook step 2

   Mitigation layers

   • Mail and content filtering: CoreGraphics parses PDF and image formats. At the mail gateway, route external PDFs and unusual image types (e.g. TIFF, PDFs containing JBIG2, HEIC, PSD) to sandbox detonation or quarantine. Apply CDR (content disarm and reconstruction) to high-risk mailboxes.
   • Messaging and proximity attack surface: Use MDM profiles to set AirDrop to "Contacts Only" or "Off". Train users not to open iMessage attachments from unknown senders. For high-risk users who cannot run Lockdown Mode, temporarily disable iMessage and FaceTime.
   • Network segmentation: Place mobile endpoints in a dedicated Wi-Fi/VPN segment with no direct route to OT, control-room or admin networks. Allow administrative access from iPads and Macs only through MFA-protected jump hosts.
   • macOS endpoint hardening: Enforce Gatekeeper, SIP and XProtect as compliance checks in MDM. Remove local admin rights so that user-context code execution does not immediately translate into system-level persistence.
   • IAM / least privilege: Revoke sessions and app passwords for any device under suspicion (e.g. Entra ID "Revoke sessions"). Shorten refresh-token lifetimes for mobile devices until the rollout is complete.
3. 03

   Runbook step 3

   Detection rules

   • Patch compliance (Defender for Endpoint / Intune): DeviceInfo | where OSPlatform == "macOS" | summarize arg_max(Timestamp,*) by DeviceId | where parse_version(OSVersion) < parse_version("15.8.1") or (parse_version(OSVersion) >= parse_version("26.0") and parse_version(OSVersion) < parse_version("26.7.1")). Do the same for iOS/iPadOS via the Intune device export with a 26.7.1 threshold.
   • Crash reports (macOS): Search /Library/Logs/DiagnosticReports and ~/Library/Logs/DiagnosticReports for crashes of Preview, QuickLookUIService, Mail, Messages/BlastDoor or Safari where the crashed thread contains CoreGraphics frames. A cluster of such crashes shortly after receiving external files is a strong signal. Query the unified log with log show --predicate 'process == "ReportCrash"' --last 7d.
   • Process ancestry (EDR, Sigma shape): Build a process_creation rule with ParentImage|endswith in (/Preview, /QuickLookUIService, /Mail, /Safari) and Image|endswith in (/sh, /bash, /zsh, /osascript, /curl, /python3). This chain is highly anomalous on macOS.
   • iOS forensics: For high-risk users' devices, capture a local backup or sysdiagnose and scan it with the Mobile Verification Toolkit (MVT) against published IOC sets once research on this campaign becomes available. Look for unexpected processes, abnormal data usage and reboot anomalies.
   • Network telemetry (Zeek/Suricata/proxy): Correlate first-seen connections from managed Apple devices to rare or newly registered domains shortly after attachment delivery. Treat low-prevalence DNS queries from the mobile segment as hunting leads.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

Source: BSI WID Portal

Vendors and products

• Apple Apple iOS
• Apple IOS And Ipados
• Apple Apple iPadOS
• Apple Apple iPhone OS
• Apple Apple macOS
• Apple Macos Sequoia
• Apple Macos Tahoe

Weakness classes (CWE)

• CWE-787Out-of-bounds Write

  Base

  The product writes data past the end, or before the beginning, of the intended buffer.

  Entry at MITRE CWE-787

References & sources

• support.apple.comen-us/149227
• support.apple.comen-us/149230
• support.apple.comen-us/149521
• support.apple.comen-us/149524
• support.apple.comen-us/149525
• support.apple.comen-us/149526
• support.apple.comen-us/149527
• support.apple.comen-us/149225
• support.apple.comen-us/149522
• support.apple.comApple support HT149226pwn-watch, Release notes, Vendor advisory
• support.apple.comen-us/149228Release notes, Vendor advisory
• support.apple.comen-us/149229Release notes, Vendor advisory
• seclists.orgfulldisclosure/2026/Sep/89Mailing list, Third-party advisory
• seclists.orgfulldisclosure/2026/Sep/90Mailing list, Third-party advisory
• seclists.orgfulldisclosure/2026/Sep/91Mailing list, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86950government-resource, US government resource
• pwn.watchpwn.watch: Apple CoreGraphics zero-day CVE-2026-86950pwn-watch
• cisa.govCISA KEVpwn-watch
• bleepingcomputer.comApple backports CoreGraphics zero-day patches to older iPhonespwn-watch
• support.apple.comApple security releasespwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 27.10.2026NVD analysis modifiedNVD

   Product mapping changed:

   • Apple iPadOS (26.0 – before 26.7.1; before 18.7.11)
   • Apple macOS (before 15.8.1; 26.0 – before 26.7.1)
   • Apple iPhone OS (before 18.7.11; 26.0 – before 26.7.1)

   New references:

   • https://support.apple.com/en-us/149225
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Product configuration	changed	OR *cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* versions up to (excluding) 26.7.1 *cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* versions up to (excluding) 15.8.1 *cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* versions up to (excluding) 26.7.1 *cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* versions from (including) 26.0 up to (excluding) 26.7.1	OR *cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* versions from (including) 26.0 up to (excluding) 26.7.1 *cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* versions up to (excluding) 15.8.1 *cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* versions from (including) 26.0 up to (excluding) 26.7.1 *cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* versions up to (excluding) 18.7.11 *cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* versions up to (excluding) 18.7.11 *cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* versions from (including) 26.0 up to (excluding) 26.7.1
   Reference type	added	—	Apple Inc.: https://support.apple.com/en-us/149225 Types: Release Notes, Vendor Advisory

   Source identifier: nvd@nist.gov

2. 26.10.2026Record modifiedApple

   Description added or changed

   New references:

   • https://support.apple.com/en-us/149225
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Description	changed	An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.	An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
   Affected versions (publisher)	added	—	Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/86xxx/CVE-2026-86950.json">CVE-2026-86950</a>
   Reference	added	—	https://support.apple.com/en-us/149225

   Source identifier: product-security@apple.com

3. 08.10.2026CISA KEV entry updated9119a7d8…

   1 individual change: Due Date

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Due Date	changed	2026-09-29	2026-09-29

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

4. 01.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	removed	{"id":"CVE-2026-86950","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T00:00:00+00:00"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-86950","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-30T03:55:58.823862Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

5. 30.09.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	removed	{"id":"CVE-2026-86950","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T14:29:32.485674Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-86950","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Linked advisories

• Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPadsThe Hacker News27.10.2026
• Multiples vulnérabilités dans les produits Apple (27 octobre 2026)CERT-FR (ANSSI)27.10.2026
• Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery PathThe Hacker News01.10.2026
• Apple Zero-Day Vulnerability Weaponized in Targeted AttacksDark Reading29.09.2026
• Apple Patches Zero-Day Linked to ‘Extremely Sophisticated Attack’SecurityWeek29.09.2026
• Vulnérabilité dans les produits Apple (29 septembre 2026)CERT-FR (ANSSI)29.09.2026
• Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th)SANS ISC Diary28.09.2026
• Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted AttacksThe Hacker News28.09.2026