CoreGraphics memory confusion in Apple iOS 26, iPadOS, macOS 26, macOS 15

CoreGraphics memory confusion flaw in Apple iOS 26, iPadOS, macOS 26, and macOS 15. CVSS 8.8 high. Apple reports possible exploitation in targeted attacks.

cat cve-2026-86950.json

Vendor: Apple
Product: iOS 26, iPadOS, macOS 26, macOS 15
CVSS: 8.8
EPSS (exploit probability): 1.2%
Status: kev
CISA patch-by (BOD 22-01): October 13, 2026
Published: September 28, 2026
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-86950

Apple released patches for CVE-2026-86950 on September 28, 2026. The vulnerability is in CoreGraphics. Affected builds: iOS 26, iPadOS, macOS 26, macOS 15.

Apple’s advisory stated it “may have been exploited in targeted attacks against specific individuals.” CISA added CVE-2026-86950 to the Known Exploited Vulnerabilities catalog on September 29, 2026, with a federal agency patch deadline of October 2, 2026. A public proof-of-concept was published October 1, 2026.

CVSS 8.8 (high). Patches available for iOS 26, iPadOS, macOS 26, and macOS 15 through Apple’s standard update channels. Full details: NVD entry, latest coverage.

Related coverage

~/articles/2026-10-01-apple-cve-2026-86950-poc-released-kev-deadline

apple

Apple CoreGraphics PoC Released, KEV Deadline Oct 2

A public PoC for CVE-2026-86950 is available as of October 1. CISA's patch deadline for federal agencies is October 2. Affected: iOS 26, iPadOS, macOS 26, macOS 15.

Oct 1read →