CVE-2026-86950CISA KEV

Apple Multiple Products Out-of-Bounds Write Vulnerability

CISA lists this Apple Multiple Products vulnerability as known exploited. The vendor's advisory has the fixed versions.

CISA catalog record

Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.

Product: Multiple Products
Added to KEV: 29 Sep 2026
Federal remediation due: 13 Oct 2026
Known ransomware use: Not reported

Page history

Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.

Cite this version

Field-level log (2)

Up to 100 recent field edits are shown; older edits may be outside retention.

23 Oct 2026 · 09:33:49 UTC Source coverage: cisa-kevIncomplete → Current
23 Oct 2026 · 08:31:50 UTC Source coverage: cisa-kevCurrent → Incomplete

Explore global source statements, affected packages and advisory history for CVE-2026-86950. The catalog has a separate collection scope from Microsoft release records.

Explicit identifiers and source references

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-86950 · Microsoft / collected KEV context

cve-program · CVE-2026-86950

Related operational evidence

Explicit CVE identifiers

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file m… · Affected-version evidence changed · 26 Oct 2026
Apple Multiple Products Out-of-Bounds Write Vulnerability · Apple · exploited, added to CISA KEV · 29 Sep 2026