Apple CoreGraphics CVE-2026-86950: exploited out-of-bounds write

CVE-2026-86950 is an out-of-bounds write in CoreGraphics, the framework Apple's systems use to draw shapes, text, images and PDF pages. Apple says processing a maliciously crafted file "may lead to arbitrary code execution", and that it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." It has not said who was targeted or how the file arrived.

Apple fixed the flaw on 28 September 2026 in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, crediting Meta Product Security with the report. CISA added it to its Known Exploited Vulnerabilities catalog the next day. Older iPhones and iPads that cannot leave iOS 18 waited four more weeks, for iOS and iPadOS 18.7.11 on 26 October.

Who is affected

Apple lists four fixed releases:

The 26.7.1 release covers iPhone 11 and later, iPad Pro 12.9-inch (3rd generation) and later, iPad Pro 11-inch (1st generation) and later, iPad Air (3rd generation) and later, iPad (8th generation) and later, and iPad mini (5th generation) and later. Apple's security releases page lists 18.7.11 for iPhone XS, iPhone XS Max, iPhone XR and iPad (7th generation), none of which can run iOS 26. The oldest model in each of those iPad families cannot run iPadOS 27, so it stays on the 26 line.

The advisories leave three groups open:

• iOS 27, iPadOS 27 and macOS Golden Gate 27. Their release notes do not list the CVE, the CVE record does not mark them affected, and Apple places the attack before iOS 27. Apple has not said outright whether they contain the flaw.
• watchOS, tvOS and visionOS. No Apple release note for them names the CVE, and the record lists only iOS, iPadOS and macOS.
• Older lines. Apple's CVE record marks every macOS before 15.8.1, and every iOS and iPadOS before 18.7.11, as affected. That includes macOS Sonoma and iPadOS 17, which have had no update since the fix; Sonoma's last was 14.8.9, on 6 August.

How the CoreGraphics bug works

Apple's documentation says CoreGraphics handles path-based drawing, anti-aliased rendering, images and "PDF document creation, display, and parsing". Apple describes the fix in one line: "An out-of-bounds write issue was addressed with improved bounds checking." CISA classes it as CWE-787, Out-of-bounds Write.

The security research firm Calif published a patch analysis, "The Great Glyph Grift", on 30 September. Comparing iOS 26.7 and 26.7.1, it found every CoreGraphics change in the anti-aliased path rasterizer, the code that turns outlines such as letter shapes into smoothed pixels. In Calif's account, the rasterizer converts coordinates to a fixed-point grid of 4096 by 4096 sub-pixels per pixel. An oversized coordinate could overflow a 32-bit integer, and two functions handled the overflow differently. The mismatch could shrink a glyph's computed bounding box, the rasterizer sized a buffer from that box, and drawing then wrote past its end. 26.7.1 clamps the value so it cannot overflow.

Calif reached the flaw with a PDF carrying a crafted embedded font, through ImageIO's thumbnail routine. Its proof of concept triggers the bug on iOS and macOS, and Calif says "going from this to code execution is another exercise entirely."

Apple publishes no CVSS score. CISA scores it 8.8 under CVSS 3.1: network attack, no privileges, user interaction required, high impact. NVD shows CISA's score and none of its own. CISA's SSVC assessment records exploitation as active, not automatable, with total technical impact. Whether the real attack needed the victim to open anything is not public.

Is it being exploited?

Apple's statement is the main public evidence: it is aware of a report that the flaw may have been exploited against specific targeted individuals on iOS before iOS 27. CISA added the CVE to KEV on 29 September "based on evidence of active exploitation", and lists ransomware use as unknown.

• A revised deadline. CISA's first entry gave federal agencies until 2 October and required forensic triage. Its 8 October update moved the due date to 13 October and dropped the triage flag, without a stated reason. The new values match BOD 26-04's 14-day row for a KEV bug that is not automatable, gives total control and sits on an asset that is not publicly exposed. Reports citing 2 October reflect the original entry.
• Meta's role. Asked by SecurityWeek, Meta said it routinely reports vulnerabilities it finds in third-party software. It did not describe the attacks or say whether WhatsApp was involved.
• A WhatsApp hint. Calif compared WhatsApp 26.37.73 and 26.38.74 and found a new, optional strict PDF check, behind a feature flag, that scores malformed or unverifiable embedded fonts as high risk. Calif calls this a "possible WhatsApp zero-click path". Neither Apple nor Meta has confirmed a delivery channel, and coverage describing a confirmed WhatsApp exploit goes beyond the evidence.

What is not public: the attacker, the victims, how many devices were hit, the delivery route, any chained bug, the payload and indicators of compromise. We found no report on this CVE from Google's Threat Intelligence Group, Citizen Lab, Amnesty International or Kaspersky.

Check your exposure

Compare each device's installed version with the table above.

• iPhone and iPad. Settings > General > Software Update shows the installed version and whether an update is waiting.
• Mac. Apple menu > About This Mac, or from Terminal:

# Installed version, for example 26.7.1 or 15.8.1
sw_vers -productVersion
 
# Updates Apple offers this Mac; lists them, installs nothing
softwareupdate --list

• Fleet. Your MDM inventory reports the OS version of every enrolled device. Filter for iOS and iPadOS 26 below 26.7.1, iOS and iPadOS 18 below 18.7.11, macOS Tahoe below 26.7.1 and Sequoia below 15.8.1. Macs on Sonoma or older and iPads on iPadOS 17 or older have no fix on their line.

Fix it

1. Install iOS or iPadOS 26.7.1 or 18.7.11, macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1, or later. The 26 October releases (iOS and iPadOS 26.7.2, macOS Tahoe 26.7.2 and macOS Sequoia 15.8.2) also fix two CoreGraphics PDF memory-corruption bugs, CVE-2026-112610 and CVE-2026-112611, which Apple does not mark as exploited.
2. On managed devices, push a Software Update declaration from your MDM: TargetOSVersion sets the version and TargetLocalDateTime when it is force-installed. Apple says it does not need supervision. iOS 18 devices need their own target.
3. Run the inventory again and confirm every device reports a fixed version.
4. Devices with no fix on their line need a newer major release or replacement. Apple lists no workaround.

Detect attempts and compromise

No indicators have been published. Apple, Meta and CISA have released no hashes, domains, file names or sender details, so detection is limited:

• Apple threat notifications. Apple alerts users it believes were individually targeted by mercenary spyware, on the iPhone and by email, and a genuine alert also shows at account.apple.com. Apple has not tied any notification to this CVE. Recipients should follow Apple's steps, including Lockdown Mode, and get expert help such as Access Now's Digital Security Helpline, which Apple recommends.
• Crash reports. Calif's proof of concept crashes in the CoreGraphics function aa_cache_render. Such a crash on an unpatched device is worth keeping, but a working exploit is built not to crash, and no crash signature from the real attacks is public. iPhone and iPad crash logs are under Settings > Privacy & Security > Analytics & Improvements > Analytics Data; Mac logs are in Console under Crash Reports.

# Crash reports naming the function Calif's proof of concept crashes in
grep -l "aa_cache_render" ~/Library/Logs/DiagnosticReports/* /Library/Logs/DiagnosticReports/* 2>/dev/null

Patching closes the flaw but removes nothing already installed. For anyone who may have been a target, a specialist forensic review beats these checks.

The long tail

The slow part of this fix was the older lines. iPhones that cannot leave iOS 18 got it four weeks after newer models, after CISA's deadline, and Macs on Sonoma have had no update since. An inventory that records each device's OS line, not just "up to date", finds those first. For where KEV and BOD 26-04 fit into patch order, see how to prioritize vulnerabilities with KEV, EPSS and CVSS.