Summary
generated automatically from NVD dataCVE-2026-86950 is an out-of-bounds write (CWE-787) affecting Apple iOS, iPadOS and macOS, where processing a maliciously crafted file may lead to arbitrary code execution. Apple states it was fixed with improved bounds checking in iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1. It is listed in the CISA KEV catalog, and Apple reports possible use in an extremely sophisticated attack against specific targeted individuals. The CVSS v3.1 score is 8.8 (HIGH).
NVD description
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-29. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-10-13
EPSS · FIRST.org
1.2%probability of exploitation in the next 30 days
Higher than 68% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 28 sept. 2026
- Updated
- 1 oct. 2026
- Status
- Analyzed
- Source
- product-security@apple.com
Affected products
Weaknesses (CWE)
References (7)
- https://support.apple.com/en-us/149226Release NotesVendor Advisory
- https://support.apple.com/en-us/149228Release NotesVendor Advisory
- https://support.apple.com/en-us/149229Release NotesVendor Advisory
- http://seclists.org/fulldisclosure/2026/Sep/89Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2026/Sep/90Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2026/Sep/91Mailing ListThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86950US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-787
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.