Affected Systems
CVE-2026-86950 affects iPhone XS, iPhone XS Max, iPhone XR, iPad 7th gen, iPad Air 4th gen and later, iPad 9th gen and later, iPad mini 6th gen and later. Previously patched in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 in September 2026. CoreGraphics framework used across iOS, macOS, iPadOS, watchOS, and tvOS.
Exploitation Status
Actively exploited in extremely sophisticated targeted attacks against specific individuals on iOS versions before iOS 27. Discovered by Meta Product Security. Second iOS zero-day exploited in 2026.
Business Impact
Out-of-bounds write vulnerability in CoreGraphics allows arbitrary code execution via maliciously crafted file. Exploitation enables attackers to crash programs, corrupt data, or achieve remote code execution. While attacks are highly targeted, the vulnerability affects widely deployed older iPhone and iPad models still in enterprise use. Organizations with legacy iOS devices face elevated risk until patches are applied.
Urgency
🟠Within 24 hours
Recommended Actions
- Immediately deploy October 2026 security updates to all affected iPhone XS, XR, XS Max, and iPad 7th/9th gen, Air 4th gen, and mini 6th gen devices
- Verify iOS 26.7.1 and iPadOS 26.7.1 patches from September are deployed on newer devices
- Review MDM logs to identify unpatched legacy iOS/iPadOS devices in your environment
- Implement file scanning and email attachment filtering to detect malicious files targeting CVE-2026-86950
- Monitor for unusual application crashes or memory corruption events on iOS devices as potential exploitation indicators