{"id":"CVE-2026-86950","kind":"vulnerability","aliases":["CVE-2026-86950"],"related":[],"title":"An out-of-bounds write issue was addressed with improved bounds checking","description":"Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Apple iOS, macOS and iPadOS have an out-of-bounds write in CoreGraphics, the graphics framework that renders images and PDFs. An attacker who gets a crafted file or content processed can run arbitrary code, and CISA lists it as exploited in the wild.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2026-09-29T00:00:00+00:00","products":[{"name":"Apple Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"apple ipados","fixed":["26.7.1"],"affected":"< 26.7.1","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["26.7.1"],"affected":"< 26.7.1","ecosystem":"vendor"},{"name":"apple macos","fixed":["15.8.1"],"affected":"< 15.8.1","ecosystem":"vendor"},{"name":"apple macos","fixed":["26.7.1"],"affected":">= 26.0, < 26.7.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","exploited","ios","ipados","macos","mobile-fleet","vendor"],"not_affected_if":["unaffected-os-version"],"how_to_check":"Check the device OS version under Settings > General > About (iOS/iPadOS) or Apple menu > About This Mac (macOS) and compare it with the fixed version in Apple's security notes.","fix":"Update iOS, iPadOS and macOS to the latest version Apple publishes with this CVE fix; the sources do not name the fixed version.\nFollow CISA BOD 26-04 guidance for devices that cannot be patched.","status":"open","published_at":"2026-09-28T20:17:11+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T19:50:08+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T19:50:08Z","model":"claude-haiku-5-5","output":{"fix":"Update iOS, iPadOS and macOS to the latest version Apple publishes with this CVE fix; the sources do not name the fixed version.\nFollow CISA BOD 26-04 guidance for devices that cannot be patched.","summary":"Apple iOS, macOS and iPadOS have an out-of-bounds write in CoreGraphics, the graphics framework that renders images and PDFs. An attacker who gets a crafted file or content processed can run arbitrary code, and CISA lists it as exploited in the wild.","category":"vendor","who_cares":["apple","ios","macos","ipados","mobile-fleet"],"confidence":0.6,"analyst_note":"Find the affected and fixed OS builds in Apple's security releases page and the CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86950.","how_to_check":"Check the device OS version under Settings > General > About (iOS/iPadOS) or Apple menu > About This Mac (macOS) and compare it with the fixed version in Apple's security notes.\nunknown","needs_analyst":true,"not_affected_if":["unaffected-os-version"],"severity_if_unknown":"high"},"cost_usd":0.000436,"input_tokens":2200,"output_tokens":432,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':125C,151C,182C '-2026':15A,18A '-86950':16A,19A '26':124C,150C,181C 'accord':114C 'action':110C 'address':9A 'adher':178C 'appl':32B,41B,86C 'apple':20A,23A,25A,28A,30A 'appli':111C 'applic':148C 'arbitrari':75B,105C 'asset':172C 'attack':64B 'base':129C 'bod':123C,149C,180C 'bound':5A,12A,51B,96C 'check':13A 'cisa':78B,108C,121C,138C 'cloud':154C 'code':76B,106C 'complianc':119C 'contain':91C 'content':71B 'coregraph':54B,100C 'craft':68B 'cve':14A,17A 'discontinu':157C 'ensur':118C,177C 'evalu':170C 'execut':107C 'exploit':33B,82B 'exposur':175C 'file':69B 'fleet':39B 'follow':147C 'forens':140C 'framework':57B 'get':66B 'graphic':56B 'guidanc':136C,152C 'guidelin':184C 'imag':60B 'improv':11A 'instruct':117C 'internet':174C 'io':34B,42B,87C 'ipado':35B,45B,90C 'ipados':24A 'iphone':26A 'issu':7A 'lead':103C 'list':79B 'maco':36B,43B,88C 'macos':29A,31A 'may':102C 'mitig':112C,163C 'mobil':38B 'mobile-fleet':37B 'multiple':21A 'note':135C,146C 'os':27A 'out-of-bound':2A,48B,93C 'patch':183C 'pdfs':62B 'priorit':126C 'process':72B 'product':161C 'products':22A 'render':59B 'requir':109C,142C 'respons':168C 'risk':131C 'run':74B 'secur':127C 'see':132C,143C 'servic':155C 'stakehold':166C 'triag':141C 'unavail':165C 'updat':128C 'url':133C,144C 'use':158C 'vendor':40B,116C 'vulner':98C 'wild':85B 'write':6A,52B,97C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-28T20:17:11+00:00","kev":{"dateAdded":"2026-09-29","dueDate":"2026-10-13","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-86950","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86950","severity":null,"published_at":"2026-09-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T20:35:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-86950","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86950","severity":null,"published_at":"2026-09-28T20:17:11+00:00","modified_at":"2026-10-01T18:17:28+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":3446,"url":"https://news.ycombinator.com/item?id=50229452","title":"CVE-2026-86950: The Great Glyph Grift","kind":"post","source":"hackernews","text":"CVE-2026-86950: The Great Glyph Grift\nhttps://calif.io/research/the-great-glyph-grift\n\n2 points, 0 comments on Hacker News","published_at":"2026-10-25T08:34:56+00:00","relation":"discussion","confidence":null,"note":"2 points, 0 comments"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}