CVE-2026-86950: Apple Patches CoreGraphics Zero-Day
Apple has patched CVE-2026-86950, an out-of-bounds write vulnerability in CoreGraphics that may allow arbitrary code execution when processing a maliciously crafted file. Apple reports possible exploitation in extremely sophisticated attacks against specific targeted individuals. Organisations should prioritise patching affected Apple devices and verify update compliance across their managed estate.
Impacted systems
| Software / application | Version / scope |
|---|---|
| iOS | Versions before iOS 27 are referenced in Apple's exploitation warning. Apple released the fix in iOS 26.7.1. Affected-device scope includes iPhone 11 and later. |
| iPadOS | Affected versions addressed by iPadOS 26.7.1. Supported devices include iPad Pro 12.9-inch (3rd generation and later), iPad Pro 11-inch (1st generation and later), iPad Air (3rd generation and later), iPad (8th generation and later), and iPad mini (5th generation and later). |
| macOS Tahoe | Fixed in macOS Tahoe 26.7.1. |
| macOS Sequoia | Fixed in macOS Sequoia 15.8.1. |
Exploitation conditions
The vulnerability is triggered when CoreGraphics processes a maliciously crafted file. Successful exploitation may permit arbitrary code execution. Apple has acknowledged reports of possible exploitation in extremely sophisticated attacks against specific targeted individuals on iOS versions before iOS 27. The public advisories do not establish the precise initial delivery vector, required user interaction, attacker identity, or a broadly applicable exploit chain. Treat vulnerable devices as at risk, particularly where users may be targeted by sophisticated threat actors.
Recommended action
- Prioritise deployment of Apple's security updates: iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, or later applicable security releases.
- Inventory managed iPhones, iPads, and Macs to identify devices running vulnerable operating system versions. Include personally owned devices where they access corporate services and fall within the organisation's management scope.
- Use MDM or endpoint management tooling to enforce update policies, monitor installation status, and follow up on devices that are offline, non-compliant, or unable to install the required release.
- Prioritise business-critical services only where relevant; for endpoint patch prioritisation, give additional weight to executive devices, privileged users, sensitive data access, and individuals at elevated risk of targeted attacks.
- Document affected assets, patch status, exceptions, compensating controls, and remediation deadlines. Validate closure rather than relying solely on update deployment reports.
Workarounds
- No vendor-confirmed workaround that fully remediates CVE-2026-86950 was identified in the supplied sources. Patching is the primary remediation.
- If immediate patching is not possible, temporarily restrict access to sensitive corporate resources from devices that remain vulnerable, where operationally feasible.
- For high-risk users, consider temporarily using a patched, managed device for sensitive work until the affected device can be updated.