CoreGraphics memory confusion in Apple iOS 26, iPadOS, macOS 26, macOS 15
CoreGraphics memory confusion flaw in Apple iOS 26, iPadOS, macOS 26, and macOS 15. CVSS 8.8 high. Apple reports possible exploitation in targeted attacks.
- Vendor
- Apple
- Product
- iOS 26, iPadOS, macOS 26, macOS 15
- CVSS
- 8.8
- EPSS (exploit probability)
- 26.2%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-86950 being exploited?
Yes. CISA added CVE-2026-86950 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in ENISA's EU Vulnerability Database (EUVD) exploited list and CIRCL's KEV catalog.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 26.2% (scored October 25, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ LISTED ]
- CIRCL KEV[ LISTED ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-86950 timeline
- Published to NVD
- First 0dayNews coverage+1d
- Added to CISA KEV+1d
- Added to EU KEV (ENISA)+1d
- Added to CIRCL KEV+14d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (14 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
Apple released patches for CVE-2026-86950 on September 28, 2026. The vulnerability is in CoreGraphics. Affected builds: iOS 26, iPadOS, macOS 26, macOS 15.
Apple’s advisory stated it “may have been exploited in targeted attacks against specific individuals.” CISA added CVE-2026-86950 to the Known Exploited Vulnerabilities catalog on September 29, 2026, with a federal agency patch deadline of October 2, 2026. A public proof-of-concept was published October 1, 2026.
CVSS 8.8 (high). Patches available for iOS 26, iPadOS, macOS 26, and macOS 15 through Apple’s standard update channels. Full details: NVD entry, latest coverage.
Other Apple CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2024-27834 Apple Multiple Products Improper Authentication Vulnerability | [ MEDIUM ] | 5.5 | 1.5% | |
| CVE-2026-65400 Apple macOS Improper Authentication Vulnerability | [ CRITICAL ] | 9.8 | 18.1% | |
| CVE-2025-43520 Apple Multiple Products Classic Buffer Overflow Vulnerability | [ MEDIUM ] | 5.5 | 0.4% | |
| CVE-2025-43510 Apple Multiple Products Improper Locking Vulnerability | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2025-31277 Apple Multiple Products Buffer Overflow Vulnerability | [ HIGH ] | 8.8 | 1.7% | |
| CVE-2023-43000 Apple Multiple products Use-After-Free Vulnerability | [ HIGH ] | 8.8 | 4.0% | |
| CVE-2023-41974 Apple iOS and iPadOS Use-After-Free Vulnerability | [ HIGH ] | 7.8 | 2.0% | |
| CVE-2021-30952 Apple Multiple Products Integer Overflow or Wraparound Vulnerability | [ HIGH ] | 7.8 | 7.0% |
