Affected Systems
CVE-2026-86950 affects CoreGraphics in older Apple devices now patched in iOS 18.7.11 and iPadOS 18.7.11 (iPhone XS/XS Max/XR, iPad 7th gen, iPad Air 4th gen+, iPad 9th gen+, iPad mini 6th gen+). Originally patched in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. Exploited in sophisticated attacks targeting iOS versions before iOS 27.
Exploitation Status
Actively exploited in the wild. Apple confirmed the vulnerability was used in sophisticated attacks against specific targeted individuals on iOS versions before iOS 27. No public PoC mentioned.
Business Impact
Out-of-bounds write in CoreGraphics (CVSS 8.8) enables arbitrary code execution when processing malicious files. Confirmed exploitation in targeted attacks increases risk for organizations with older iPhone/iPad deployments. Attackers can achieve full code execution through file processing, potentially compromising device integrity and accessing sensitive corporate data on managed mobile devices.
Urgency
🔴 Immediate
Recommended Actions
- Immediately update all supported older iPhones and iPads to iOS 18.7.11 or iPadOS 18.7.11
- Update newer devices to iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, or macOS Sequoia 15.8.1 if not already patched
- Verify patch deployment via MDM for all managed Apple devices, prioritizing iPhone XS/XS Max/XR and iPad 7th gen models
- Review mobile device logs for suspicious file processing activity or unexpected code execution on CoreGraphics prior to patching
- Educate users to avoid opening untrusted files on mobile devices until patches are confirmed deployed