Live › vulnerability › CVE-2026-86950
Go to dashboardApple iOS, macOS and iPadOS have an out-of-bounds write in CoreGraphics, the graphics framework that renders images and PDFs. An attacker who gets a crafted file or content processed can run arbitrary code, and CISA lists it as exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Apple Multiple Products | vendor | – | – |
| apple ipados | vendor | < 26.7.1 | 26.7.1 |
| apple iphone os | vendor | < 26.7.1 | 26.7.1 |
| apple macos | vendor | < 15.8.1 | 15.8.1 |
| apple macos |
| vendor |
| >= 26.0, < 26.7.1 |
| 26.7.1 |
Check the device OS version under Settings > General > About (iOS/iPadOS) or Apple menu > About This Mac (macOS) and compare it with the fixed version in Apple's security notes.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Hacker News · Hacker News2 points2026-10-25 08:34“CVE-2026-86950: The Great Glyph Grift https://calif.io/research/the-great-glyph-grift”
View on Hacker News
Posts are quoted with a link to the original. They are data to us, never instructions.
Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2026-86950")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.