cyfenced.com →

[ CVE-2026-86950 · Published 28 Sep 2026 ]

Exploited out-of-bounds write in Apple iOS, iPadOS and macOS

Exploited · CISA KEV CVSS 8.8 EPSS 1%3 agency advisoriesFix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-09-29

[ Analyst view ]Is this a red alert for you?

Patch within days

Apple and CISA report exploitation, but it needs a user to process a crafted file and has so far been used against specific targets.

Red alert if
Staff with access to sensitive information, such as executives, use unpatched Apple devices and could be targeted individually.
Can wait if
Your Apple devices update automatically and you confirm through device management that they have updated within a few days.
What it is
An out-of-bounds write flaw in Apple's software lets a maliciously crafted file run code when it is processed. It is fixed in iOS and iPadOS 26.7.1, macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1, and Apple is aware of a report that it was used in an extremely sophisticated attack against specific people.
Impact
A crafted file that a user opens or receives can give an attacker control of the iPhone, iPad or Mac. A compromised device exposes email, messages, files and the accounts the user is signed in to, which matters most for staff with access to sensitive information.

How an attack would work MITRE ATT&CK

  1. T1566 PhishingThe crafted file is sent to the target, for example as an attachment or message.
  2. T1203 Exploitation for Client ExecutionProcessing the file triggers the memory flaw and runs the attacker's code.
  3. T1005 Data from Local SystemData on the device, such as files and messages, is collected.

What to do

  1. Update iPhones and iPads to iOS and iPadOS 26.7.1 or later, and Macs to macOS Sequoia 15.8.1, Tahoe 26.7.1 or later.
  2. Use your device management tool to enforce the update and report devices that have not updated.
  3. Consider Lockdown Mode for staff at high risk of targeted attacks.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

CISA: Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 13 Oct 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

[ Advisories ]Government CERT advisories

[ References ]References