Affected Systems

CVE-2026-86950 affects CoreGraphics in iOS versions before 26.7.1, iPadOS before 26.7.1, macOS Tahoe before 26.7.1, and macOS Sequoia before 15.8.1. Impacted devices include iPhone 11 and later, iPad Pro (3rd gen 12.9-inch and 1st gen 11-inch and later), iPad Air 3rd gen and later, iPad 8th gen and later, iPad mini 5th gen and later, and Macs running macOS Tahoe or Sequoia.

Exploitation Status

Active exploitation confirmed. Apple states the vulnerability may have been exploited in extremely sophisticated attacks against specific targeted individuals on iOS versions before iOS 27. Meta Product Security discovered and reported the issue. No public PoC available.

Business Impact

Out-of-bounds write in CoreGraphics enables arbitrary code execution when processing maliciously crafted files. Exploitation requires user interaction (opening a malicious file). Apple confirmed targeted attacks but provided no details on scope, success rate, or timeline. High severity due to code execution capability and confirmed in-the-wild exploitation, though limited to targeted attacks rather than mass exploitation. Organizations with high-value targets (executives, researchers, activists) face elevated risk.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Deploy iOS 26.7.1 and iPadOS 26.7.1 to all supported iPhones (11 and later) and iPads immediately
  • Update Macs running macOS Tahoe to version 26.7.1 and macOS Sequoia to version 15.8.1
  • Prioritize patching for high-value targets including executives, researchers, and users handling sensitive data
  • Review MDM logs and Apple device management systems to identify devices running vulnerable iOS versions before iOS 26.7.1
  • Educate users on risks of opening untrusted files from unknown sources, particularly on unpatched devices