Apple CoreGraphics CVE-2026-86950: Exploited Zero-Day

What to do

1. Check every Mac with sw_vers -productVersion and every iPhone and iPad in MDM; anything below 26.7.1 (iOS, iPadOS, Tahoe) or 15.8.1 (Sequoia) needs the update.
2. Install the update: softwareupdate --install --all --restart on Macs, Settings > General > Software Update on iPhone and iPad.
3. Enforce a minimum OS version with a deadline in your MDM, and block corporate access from devices that miss it.
4. Flag Macs on macOS Sonoma and iPhones on iOS 18, which got no update for this bug, for replacement or restricted access.
5. For high-risk users, turn on Lockdown Mode as general hardening; Apple has not said whether it would have stopped this attack.

How to check if you are affected or compromised

• Apple has published no indicators of compromise; there is no reliable way for most teams to confirm targeting.
• Review crash reports (.ips files in ~/Library/Logs/DiagnosticReports and /Library/Logs/DiagnosticReports on Macs; Analytics Data on iPhone) for crashes inside CoreGraphics, such as aa_cache_render, after opening or previewing a PDF; a crash is a lead, not proof.
• If a person may have been singled out, get a professional mobile forensics review rather than relying on crash logs, since a working exploit may leave no crash.

What happened#

On September 28, 2026, Apple released iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Each update fixes a single bug, CVE-2026-86950, an out-of-bounds write in CoreGraphics, the system framework that draws 2D graphics, fonts and PDF pages. Apple's description reads: "Processing a maliciously crafted file may lead to arbitrary code execution." Its iOS security note adds: "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." Apple credits Meta Product Security with the report.

CISA added the CVE to the KEV catalog on September 29, with a federal deadline of October 13. CISA's ADP scores it CVSS 3.1 8.8: reachable over the network, no privileges needed, but the victim has to process the file. NVD uses the same score.

Apple has not said who was targeted, how the file was delivered or who was behind the attack. On September 30, researchers at Calif published a root-cause analysis based on a diff of iOS 26.7 and 26.7.1. They found that CoreGraphics was the only library that changed. The bug sits in the glyph rasterizer's float-to-fixed-point coordinate conversion: a glyph's bounding box comes out too small, so the coverage buffer is undersized and aa_cache_render writes past its end. Their trigger is a PDF with a crafted embedded TrueType font. It crashes macOS, and iOS according to Calif, through the ImageIO thumbnail path that apps use to preview attachments. The PoC does not achieve code execution, and Calif did not have the in-the-wild sample. Calif also noticed that a recent WhatsApp build added checks for malformed PDF font programs. It calls that circumstantial evidence of a possible delivery path, and The Hacker News notes that WhatsApp has published no advisory linking the two.

Who is affected#

Affected: iPhone 11 and later, plus the iPads listed in Apple's note, on iOS or iPadOS 26 before 26.7.1, and Macs on macOS Tahoe before 26.7.1 (Tahoe note) or Sequoia before 15.8.1 (Sequoia note). Some older iPads, such as the iPad 8th generation, iPad Air 3rd generation and iPad mini 5th generation, cannot move to iOS 27, so they need 26.7.1.

The CVE record lists no other affected versions. Apple shipped iOS 27 and macOS Golden Gate 27 on September 14, and their security notes do not mention this CVE. The 27.0.1 updates released on September 28 have no published CVE entries, according to Apple's security releases page. Apple has not released a fix for macOS Sonoma or for iOS 18 on the iPhone XS and XR. Whether those versions contain the bug is not disclosed as of Oct 21, 2026.

Do you really need to act?#

Yes, but this is an inventory job, not a fire drill. Apple describes a targeted attack, not mass exploitation, and the fix has been out for three weeks, so devices that install updates automatically are likely already covered. Two things raise the stakes for everyone else. First, the bug is in file parsing that can run when a received document is merely previewed, so the user interaction required may be small. Second, a public crash trigger and a patch diff now exist, which lowers the cost for others to build a working exploit.

Prioritize people who are plausible targets, and any device that has fallen behind on updates or cannot update at all. Apple has not said whether Lockdown Mode would have blocked the delivery path.

What to do now#

1. Check versions. On Macs, run sw_vers -productVersion. For iPhones and iPads, pull an OS version report from your MDM.
2. Update anything below the fixed builds. On Macs, run softwareupdate --list, then sudo softwareupdate --install --all --restart. On iPhone and iPad, go to Settings > General > Software Update.
3. Enforce a minimum OS version with a deadline through MDM, and block corporate access from devices that miss it.
4. Identify Sonoma Macs and iOS 18 iPhones, which got no update for this bug, and plan to replace them or restrict their access.
5. For high-risk staff, turn on Lockdown Mode (Settings > Privacy & Security) as general hardening.

How to tell if you were hit#

Apple has published no indicators of compromise, and most teams have no reliable way to confirm targeting. A low-cost check is crash reports. Calif's crash ends inside CoreGraphics in aa_cache_render. On Macs, look in ~/Library/Logs/DiagnosticReports and /Library/Logs/DiagnosticReports for .ips files showing CoreGraphics crashes in apps that preview files. On iPhone, look under Settings > Privacy & Security > Analytics & Improvements > Analytics Data. Treat a crash as a lead, not proof: a working exploit may leave no crash at all. If someone may have been singled out, arrange a professional mobile forensics review.

Timeline#

• Sep 14, 2026 — Apple ships iOS 27 and macOS Golden Gate 27. Their security notes do not list CVE-2026-86950.
• Sep 28, 2026 — Apple releases iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 with the fix, noting possible exploitation. The CVE is published.
• Sep 29, 2026 — CISA adds CVE-2026-86950 to KEV.
• Sep 30, 2026 — Calif publishes its root-cause analysis and crash trigger.
• Oct 13, 2026 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2026-86950 · KEV 2026-09-29 · An out-of-bounds write issue was addressed with improved bounds checking.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Apple — About the security content of iOS 26.7.1 and iPadOS 26.7.1 support.apple.com
2. Apple — About the security content of macOS Tahoe 26.7.1 support.apple.com
3. Apple — About the security content of macOS Sequoia 15.8.1 support.apple.com
4. CVE record — CVE-2026-86950 cve.org
5. NVD — CVE-2026-86950 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2026-86950 cisa.gov
7. Apple — Apple security releases support.apple.com
8. Calif — CVE-2026-86950: The Great Glyph Grift calif.io
9. Calif / GitHub — CVE-2026-86950 trigger and write-up github.com

Coverage and analysis

1. The Hacker News — Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path thehackernews.com