# Apple CoreGraphics Out-of-Bounds Write (CVE-2026-86950) Possibly Exploited in Targeted Attacks

> Apple patched CVE-2026-86950, an out-of-bounds write in the CoreGraphics framework that can lead to arbitrary code execution when a maliciously crafted file is processed. Apple says it is aware of a report that the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27; Meta Product Security reported it.

- **Published:** 2026-09-28T00:00:00Z
- **Last reviewed:** 2026-10-03T16:36:02.489Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2745
- **ID:** TL-2026-2745
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-86950

## Description

CVE-2026-86950 is an out-of-bounds write (CWE-787) in CoreGraphics, Apple's core 2D drawing and rendering framework. All three Apple advisories describe the impact as: processing a maliciously crafted file may lead to arbitrary code execution. The fix is described as 'improved bounds checking'. The flaw is fixed in iOS 26.7.1 and iPadOS 26.7.1 (iPhone 11 and later; iPad Pro 12.9-inch 3rd generation and later; iPad Pro 11-inch 1st generation and later; iPad Air 3rd generation and later; iPad 8th generation and later; iPad mini 5th generation and later), macOS Tahoe 26.7.1 (build 25G241 per 9to5Mac) and macOS Sequoia 15.8.1 (build 24H32 per 9to5Mac). The advisories (support.apple.com 149226, 149228, 149229) were released on 2026-09-28, each contains only this single CVE, and each credits Meta Product Security.

Exploitation status: Apple states it is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. This is a possible-exploitation statement, not a confirmed in-the-wild campaign. Apple published no details on how many people were targeted, whether any attempt succeeded, when exploitation began, the delivery vector, the file format, or the threat actor. The exploitation wording appears only in Apple's text; the advisories for macOS Tahoe and macOS Sequoia repeat the same sentence but name iOS as the exploited platform, so no macOS exploitation is stated. The NVD record (CNA: product-security@apple.com, status 'Received') carries a CISA-ADP SSVC v2.0.3 assessment of Exploitation: None, Automatable: No, Technical Impact: Total, so the exploitation claim rests on Apple's vendor statement alone. The CVE was reserved on 2026-09-08 (per Strix and OffSeq aggregator data) and published in NVD on 2026-09-28 at 20:17 UTC. It is not listed in the CISA KEV catalog: the KEV JSON re-retrieved during this research pass is still catalog version 2026.09.27 (1,728 entries, released 2026-09-27), which predates the disclosure, so absence from KEV is expected and should be re-checked; Strix also reports no KEV listing. No public proof-of-concept was found in any source or search, and searches for Citizen Lab, Amnesty, Google TAG or Lookout involvement returned nothing: the only credited reporter is Meta Product Security.

Severity: the NVD record scores it CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; exploitability 2.8, impact 5.9). The vector implies network delivery of a file and user interaction; Apple states only that the file is 'processed', so a delivery path that needs no explicit user action cannot be ruled out from public information. Scope is Unchanged, and Apple describes code execution only; no sandbox escape or privilege escalation is stated. OffSeq's phrase 'full device compromise' is aggregator characterization, not Apple text.

OS branch context: iOS 27 shipped on 2026-09-14 (per AppleMagazine), the same day as Apple's large September update wave (iOS/iPadOS 27 and 26.7, macOS 27 Golden Gate, macOS Tahoe 26.7, macOS Sequoia 15.8, tvOS/watchOS/visionOS 27, Safari 27, Xcode 27; 273 CVEs per the Zero Day Initiative review, which also notes several crafted-file image-parsing fixes such as ImageIO CVE-2026-65346 and a separately CISA-confirmed exploited Screen Sharing Server flaw, CVE-2026-65400; neither is linked to CVE-2026-86950 by any source). iOS 27.0.1, iPadOS 27.0.1 and macOS Golden Gate 27.0.1 (build 26A5434 per 9to5Mac) were released the same day as the 26.7.1 updates and Apple's advisories for them carry no published CVE entries, so CVE-2026-86950 is not listed as fixed in them (MacRumors, AppleMagazine, 9to5Mac). Apple's phrase 'versions of iOS before iOS 27' therefore bounds the reported exploitation, but the advisories do not say whether iOS 27.0 itself was vulnerable; the only fixed builds Apple lists are the 26.x ones. MacRumors, 9to5Mac and AppleMagazine infer the iOS 27 branch already carries the fix; that is press inference, not an Apple statement. Reporting is inconsistent on the boundary: AppleMagazine frames exposure as 'versions older than iOS 26.7.1', MacRumors as 'iOS 26 and earlier', Apple's wording is 'before iOS 27', and TidBITS states iOS/iPadOS before 27.0 are patched in 27.0.1, which conflicts with Apple's own 27.0.1 advisories listing no CVEs.

Source discrepancies: TheHackerWire titles the record 'OS Command Injection' while quoting the official out-of-bounds-write description and CWE-787; the vendor and NVD data are authoritative and this record follows CWE-787. Strix and OffSeq list iOS/iPadOS as the affected product with macOS Sequoia and Tahoe as additional affected products (matching NVD ranges: iOS/iPadOS < 26.7.1, Tahoe < 26.7.1, Sequoia < 15.8.1). TidBITS links to Pegasus as an example of spyware but cites no evidence that the flaw is used in it; no other source repeats this and it is NOT treated as attribution here.

Intelligence gaps: no malware family, implant, C2 infrastructure, file hashes, file format, or attribution has been published, so no BeaconBeagle pivot is possible (there are no network IOCs to query). The IOC list therefore contains only vulnerability, component, device, and version/build artifacts useful for exposure and patch-compliance hunting, not adversary infrastructure. The MITRE mapping is limited to what follows from stated facts: exploitation of a client-side flaw for initial access and code execution (mobile T1664/T1658 and the enterprise T1203 for the macOS builds), a crafted file that must be processed/opened (T1204.002), possession of an exploit and vulnerability knowledge for a pre-patch attack (T1587.004, T1588.005, T1588.006; Apple does not say whether the exploit was developed or acquired, so both are listed), and selection of specific individuals (T1589, inferred from the 'specific targeted individuals' wording). Apple did not disclose the delivery vector or any post-exploitation behavior, so no phishing, drive-by, sandbox-escape, privilege-escalation, persistence, collection or exfiltration techniques are mapped; adding them would be invention. Apple's exploitation wording matches its earlier disclosure for the dyld flaw CVE-2026-20700 (patched 2026-02-11/12 in iOS 26.3 and companion releases, reported by Google TAG, exploited in an extremely sophisticated attack against targeted individuals on iOS before iOS 26; Apple noted it was related to WebKit CVE-2025-43529 and Chrome ANGLE CVE-2025-14174 patched in December 2025), but no source links the two issues and no source says CVE-2026-86950 was part of an exploit chain.

Component precedent (context only): CoreGraphics (the Quartz graphics layer) was also the component in FORCEDENTRY (CVE-2021-30860, September 2021, found by Citizen Lab, attributed to NSO Group's Pegasus), where a PDF disguised as a GIF carrying JBIG2 data triggered an integer overflow delivered via iMessage. No source ties CVE-2026-86950 to that exploit, its file format, its delivery channel or its vendor; it is recorded only so defenders know that crafted-file parsing in CoreGraphics has previously been a spyware entry point. MacRumors characterizes the exploitation as targeting 'a small number of people' and not widespread, and warns that public disclosure raises the risk of copycat exploitation; Apple itself gives no such figures. The VulDB record for this CVE (vuldb.com/vuln/411158) appears in search results but returned HTTP 403 and could not be read. For the earlier CVE-2026-20700 disclosure, Malwarebytes describes an infection chain with CVE-2025-14174 and CVE-2025-43529 and recommends Apple Lockdown Mode for high-value targets; no source makes that recommendation for CVE-2026-86950 specifically.

MITRE mapping scope: eight techniques are mapped and each rests on a stated fact (client-side flaw exploited via a crafted file, targeting of specific individuals, exploit possession). Delivery-vector techniques (Phishing T1566/T1660, Drive-by Compromise T1189, Malicious Image T1204.003) and any post-exploitation technique were deliberately left out because Apple did not disclose the delivery vector, file format or post-exploitation behavior.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1587.004 Exploits
- T1588.005 Exploits
- T1588.006 Vulnerabilities
- T1664 Exploitation for Initial Access
- T1658 Exploitation for Client Execution
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File

## Sources

- [About the security content of iOS 26.7.1 and iPadOS 26.7.1](https://support.apple.com/en-us/149226)
- [About the security content of macOS Tahoe 26.7.1](https://support.apple.com/en-us/149228)
- [About the security content of macOS Sequoia 15.8.1](https://support.apple.com/en-us/149229)
- [Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks - The Hacker News](https://thehackernews.com/2026/09/apple-patches-coregraphics-flaw.html)
- [NVD CVE-2026-86950 record](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-86950)
- [CISA Known Exploited Vulnerabilities catalog (v2026.09.27 checked twice: CVE-2026-86950 not listed; snapshot predates disclosure)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [iOS 26.7.1 Fixes Vulnerability Used in Targeted Attacks - MacRumors](https://www.macrumors.com/2026/09/28/ios-26-7-1-active-exploit-fixed/)
- [iOS 26.7.1 Fixes iPhone Flaw Used in Sophisticated Targeted Attacks - AppleMagazine](https://applemagazine.com/ios-26-7-1-security-fix-iphone/)
- [iOS 26.7.1 available now for iPhone with security fixes - 9to5Mac](https://9to5mac.com/2026/09/28/ios-26-7-1-available-now-for-iphone-with-security-fixes/)
- [Apple releases macOS 27.0.1 Golden Gate, plus macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 (build numbers) - 9to5Mac](https://9to5mac.com/2026/09/28/apple-releases-macos-27-0-1-golden-gate-plus-macos-tahoe-26-7-1-and-macos-sequoia-15-8-1/)
- [Apple Patches Zero-Day Exploit Alongside September 2026 OS Fixes - TidBITS (unsourced Pegasus mention; conflicts with Apple on 27.0.1)](https://tidbits.com/2026/09/28/apple-patches-zero-day-exploit-alongside-september-2026-%EF%A3%BFos-fixes/)
- [The Apple Security Update Review for September 2026 - Zero Day Initiative (context: 2026-09-14 update wave)](https://www.zerodayinitiative.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026)
- [CVE-2026-86950: iOS and iPadOS Out-of-Bounds Write (CVSS 8.8) - Strix](https://www.strix.ai/cve/CVE-2026-86950)
- [CVE-2026-86950 - OffSeq Threat Radar](https://radar.offseq.com/threat/cve-2026-86950-processing-a-maliciously-crafted-file-may-lead-to-arbitrary-code-execution-apple-is-085d64751b18931e)
- [CVE-2026-86950 - threatint CVE record](https://cve.threatint.com/CVE/CVE-2026-86950)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2745