CVE-2026-86950: Apple CoreGraphics Out-of-Bounds Write Enables Arbitrary Code Execution on iOS, iPadOS, and macOS

Background

CoreGraphics is Apple’s foundational 2D rendering framework, used across iOS, iPadOS, and macOS to draw and process images, PDFs, fonts, and other graphical content. Because CoreGraphics sits underneath nearly every surface that renders visual content — Messages, Mail, Safari, Preview, Photos, and countless third-party apps — a memory-safety flaw in this framework can often be triggered simply by having a device render a maliciously crafted piece of content, with no further user action required beyond viewing it.

This structural exposure is why CoreGraphics and related Apple graphics/parsing frameworks have repeatedly been the target of sophisticated exploitation, including in zero-click or near-zero-click attack chains used against high-value targets.

Technical Mechanism

CVE-2026-86950 is classified under CWE-787 (Out-of-Bounds Write). The KEV shortDescription states that “Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.”

An out-of-bounds write occurs when a program writes data to a memory location outside the boundaries of an allocated buffer, typically because the code fails to correctly validate the size or structure of input before writing it into a fixed or dynamically allocated buffer. In the context of a graphics-processing framework like CoreGraphics, this pattern commonly plays out as follows:

1. CoreGraphics parses and processes a graphical content format (this can include image formats, PDF structures, or font data) as part of normal rendering operations triggered by opening a document, viewing an image, or rendering a web page or message.
2. A maliciously crafted file in one of these formats contains structural data (such as declared dimensions, object counts, or embedded resource tables) that does not match the actual data that follows it, and CoreGraphics’s parsing logic does not adequately validate this mismatch before allocating and writing to a buffer sized according to the (incorrect) declared values.
3. As CoreGraphics processes the malformed content, it writes data beyond the bounds of the allocated buffer, corrupting adjacent heap or stack memory.
4. Depending on what memory structures are corrupted — object metadata, function pointers, or other control-flow-relevant data — a sufficiently crafted overflow can be leveraged to redirect program execution, which is what the KEV description refers to when it says the flaw “may lead to arbitrary code execution.”
5. Because rendering is often an automatic, low-interaction operation (previewing an image in Messages, rendering a PDF attachment, or loading a web page), this class of vulnerability is a common building block for exploit chains that require minimal or no explicit user interaction beyond viewing content.

Real-World Exploitation Evidence

CVE-2026-86950 was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on 2026-09-29. KEV listing confirms CISA has verified active, real-world exploitation of this vulnerability.

Regarding ransomware: the KEV record lists knownRansomwareCampaignUse as “Unknown.” CISA has not confirmed use of this vulnerability in ransomware campaigns at this time — consistent with the broader pattern that mobile/desktop memory-corruption vulnerabilities of this kind are more commonly associated with targeted surveillance or espionage-style exploitation than with ransomware deployment, though CISA’s KEV status speaks only to confirmed exploitation, not to attacker motive.

No specific threat actor, intrusion set, or campaign name has been publicly attributed to exploitation of this CVE in the data available at the time of writing. Its KEV listing confirms active exploitation in the wild, but attribution detail is not yet public. Apple’s own security advisories for actively exploited vulnerabilities in frameworks like CoreGraphics have, in the past, sometimes referenced exploitation against specific individuals (such as journalists, activists, or government officials) by sophisticated actors using commercial spyware tooling — organizations and at-risk individuals should treat prompt patching as the priority regardless of whether such attribution is eventually confirmed for this specific CVE.

Impact Assessment

A CVSS score of 8.8 at the high severity tier reflects a serious memory-corruption vulnerability with the potential for full code execution, which is reflected in CISA’s framing of “may lead to arbitrary code execution.”

What an attacker achieves:

• Arbitrary code execution: If successfully weaponized beyond a simple crash, this vulnerability allows an attacker to run their own code within the context of the process that invoked CoreGraphics — which, depending on the calling application, could range from a sandboxed app process to a more privileged system component.
• Confidentiality and integrity: Code execution within an app’s context can expose data accessible to that app (messages, photos, documents) and, depending on sandbox escape potential in a broader exploit chain, could extend further into device data and functionality.
• Low-interaction trigger: Because CoreGraphics rendering is often triggered automatically (viewing a received image or message preview, loading a webpage, or opening a document), this vulnerability class does not require a victim to take an unusual or suspicious action — simply receiving and having a device render the malicious content may be sufficient.
• Device/process crash as a baseline: Even where full code execution is not achieved, out-of-bounds writes reliably cause application or process crashes, representing an availability impact at minimum.

Sector-specific risk: Because iOS, iPadOS, and macOS devices are used across virtually every sector, the risk here is broad. Organizations with bring-your-own-device (BYOD) policies or that issue Apple hardware to employees handling sensitive information — including executives, legal counsel, and government or diplomatic personnel — face elevated risk given this vulnerability class’s historical association with high-value targeted surveillance exploitation.

Affected Versions

The KEV record does not specify exact affected version ranges in the fields provided. Apple’s own support advisories are the authoritative source for the specific list of affected and patched OS versions.

Organizations should consult Apple’s security advisories — support.apple.com/en-us/149226, 149228, and 149229 — for the definitive list of affected device models, OS version ranges, and the specific patched release for each platform, as the KEV data supplied does not enumerate specific version boundaries.

Remediation Steps

CISA’s required action is to apply mitigations per vendor instructions, in compliance with BOD 26-04 and its Forensics Triage Requirements.

1. Update all affected Apple devices to the patched iOS, iPadOS, and macOS versions referenced in Apple’s security advisories immediately.

   # On iOS/iPadOS: Settings > General > Software Update
   # On macOS:
   softwareupdate --list
   softwareupdate --install --all

2. Prioritize devices belonging to higher-risk users (executives, legal, government-adjacent, or personnel handling sensitive communications) for immediate update rollout, given this vulnerability class’s history of targeted exploitation.
3. Enable automatic updates on managed and personal devices where organizational policy allows, to reduce the window of exposure for future similarly-delivered vulnerabilities.
4. For managed fleets, push the update via MDM (Mobile Device Management) with a compliance deadline, and flag non-compliant devices for follow-up.
5. Conduct forensic triage on any device that handles high-sensitivity communications and was unpatched prior to 2026-09-29, per BOD 26-04 Forensics Triage Requirements — particularly for devices belonging to individuals who may be specifically targeted.
6. Consider Apple’s Lockdown Mode for users at elevated risk of targeted attacks, as an additional defense-in-depth measure that restricts certain message/attachment processing surfaces that vulnerabilities like this one rely on.

Detection Guidance

Exact IOCs or signatures specific to this CVE have not been published in the data available; the following detection strategies are appropriate for a mobile/desktop OS memory-corruption vulnerability of this kind:

• Mobile Device Management (MDM) compliance reporting: Track OS version compliance across the managed fleet to identify devices still running vulnerable versions after the patch has been released.
• Crash log review: Review device crash logs (via MDM or direct device diagnostics) for CoreGraphics-related crashes, which — while not conclusive proof of exploitation — can indicate failed or exploratory exploitation attempts against the vulnerable code path.
• Mobile threat defense (MTD) tooling: Where deployed, review MTD/EMM security tooling for anomaly detection related to unexpected process behavior following media or document rendering.
• Network-layer indicators: Because this vulnerability is likely delivered via a malicious file, image, or message rather than direct network exploitation, network-layer detection is of limited value; email and messaging-gateway-level content filtering for suspicious attachments is a more relevant complementary control.

Because exact forensic indicators specific to this CVE have not been published by Apple, organizations with reason to believe a specific device may have been targeted should consider engaging mobile forensics specialists and should monitor Apple’s security advisories for any subsequent detail.

Timeline

References

• Apple Security Advisory — support.apple.com/en-us/149226
• Apple Security Advisory — support.apple.com/en-us/149228
• Apple Security Advisory — support.apple.com/en-us/149229
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements
• NVD — CVE-2026-86950