CVE-2026-86950CISA KEV

Apple Multiple Products Out-of-Bounds Write Vulnerability

CISA lists this Apple Multiple Products vulnerability as known exploited. The vendor's advisory has the fixed versions.

CISA catalog record

Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.

Product: Multiple Products
Added to KEV: 29 Sep 2026
Federal remediation due: 13 Oct 2026
Known ransomware use: Not reported

Page history

Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.

Cite this version

Field-level log (2)

Up to 100 recent field edits are shown; older edits may be outside retention.

23 Oct 2026 · 09:33:49 UTC Source coverage: cisa-kevIncomplete → Current
23 Oct 2026 · 08:31:50 UTC Source coverage: cisa-kevCurrent → Incomplete

Explore global source statements, affected packages and advisory history for CVE-2026-86950. The catalog has a separate collection scope from Microsoft release records.

cve-program · CVE-2026-86950

Published

iOS and iPadOS

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Apple",
                    "product": "iOS and iPadOS",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThan": "18.7.11",
                            "versionType": "custom"
                        },
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThan": "26.7.1",
                            "versionType": "custom"
                        }
                    ]
                }

macOS

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Apple",
                    "product": "macOS",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThan": "15.8.1",
                            "versionType": "custom"
                        },
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThan": "26.7.1",
                            "versionType": "custom"
                        }
                    ]
                }