Apple CoreGraphics CVE-2026-86950 in CISA KEV: Out-of-Bounds Write on iOS, iPadOS and macOS

On September 29, 2026, CISA added CVE-2026-86950 to its KEV catalog: an out-of-bounds write in CoreGraphics, Apple's 2D graphics rendering engine, on iOS, iPadOS and macOS. It may lead to arbitrary code execution, and it's being exploited. Remediation deadline: October 13.

NVD hasn't published a score, vector or version list at the time of writing. I'm relying solely on the CISA entry. For fixed versions, the reference is Apple's security release notes ("About the security content of…") for each OS: I won't invent a version number.

What CISA Says

Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.

An out-of-bounds write is a program writing past the memory region allocated to it. In a component that parses data from outside, it's the class of flaw that most directly lets an attacker hijack execution.

Why CoreGraphics Is a Sensitive Attack Surface

CoreGraphics (Quartz 2D) draws images, PDFs and a good part of the interface on every Apple system. It's called whenever an app displays graphical content — and that content often comes from outside: attachments, web pages, documents, messages.

What makes these flaws valuable to an attacker is that ubiquity: the vulnerable code is on every device, in a component the user never sees and can't turn off.

CISA doesn't specify the exploitation vector (crafted file, user interaction or not) or the targets' profile. I won't guess. Historically, Apple flaws of this kind exploited in the wild have often been used in targeted attacks: executives, journalists, people with sensitive access. That doesn't mean it's the case here, but it justifies handling those populations' devices first.

Versions

Nothing from NVD at the time of writing. In practice:

• check Apple's security release notes and find the update that lists CVE-2026-86950 for iOS, iPadOS and macOS
• check whether Apple also shipped a fix for older branches (previous iOS or macOS versions still supported): devices that can't move to the latest major release depend on it
• a device that's no longer supported won't get the fix: it should leave business use

Detection

For this kind of flaw, endpoint-side detection is hard: exploitation happens inside a system process's memory. What's realistic:

• Version inventory through your MDM: that's the real indicator, device by device
• Unusual crash reports from rendering or preview processes, surfaced by the MDM or visible in system logs
• For high-risk profiles, Apple's threat notifications sent to targeted users, if one of them reports receiving one

Mitigation

1. Update iOS, iPadOS and macOS to the versions that fix CVE-2026-86950 per Apple's security release notes. CISA deadline: October 13.
2. Enforce the update through MDM, with a deadline, rather than letting users postpone it indefinitely.
3. Start with exposed populations: leadership, communications, legal, administrators, and all mobile users.
4. Enable Lockdown Mode for very high-risk profiles: it shrinks the attack surface by restricting how some content is processed.
5. Retire or isolate devices that no longer receive updates.

Why Continuous Monitoring of Your Apple Fleet Matters

Laptops and phones are rarely in the vulnerability inventory, even though they process outside content every day. An exploited flaw in a system graphics component is exactly the scenario where you need to know within minutes which devices are behind.

With cveo.tech, inventory your systems with their versions, and get alerted as soon as a CISA KEV CVE affects them.