CVE-2026-86950: exploited Apple CoreGraphics zero-day

Call: Patch now. CVE-2026-86950 is an out-of-bounds write in CoreGraphics. Opening a malicious file gets code execution. Apple says it “may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” CISA added it to KEV on September 29, and the federal due date was October 13. Meta Product Security found it.

What changed since September:

There’s a public proof of concept. Calif’s write-up, “The Great Glyph Grift,” shows it triggered by a PDF with a crafted TrueType font. A bug that used to be for “specific targeted individuals” now has instructions. There’s also an open-source detector for suspicious files.
Older devices got the fix on October 26. iOS and iPadOS 18.7.11 cover the iPhone XS, XS Max and XR and the 7th-generation iPad, which can’t run 26.
Newer versions are out. iOS/iPadOS 26.7.2, macOS Tahoe 26.7.2 and Sequoia 15.8.2 shipped the same day. They include the fix, so go straight to them.

Who’s hit:

iOS and iPadOS before 26.7.1 (iPhone 11 and later, and the listed iPads)
iOS and iPadOS 18 before 18.7.11
macOS Tahoe before 26.7.1
macOS Sequoia before 15.8.1

Apple doesn’t list iOS 27 as affected.

Workaround: None. Update to iOS/iPadOS 26.7.2 (or 18.7.11 on the older hardware), macOS Tahoe 26.7.2 or Sequoia 15.8.2, or move to 27. On managed fleets, enforce a minimum OS version rather than trusting that people will tap “Later” fewer times than usual.

Sources: BleepingComputer: zero-day (opens in a new tab), BleepingComputer: backport (opens in a new tab), Apple: iOS 18.7.11 (opens in a new tab), Apple security releases (opens in a new tab), NVD (opens in a new tab), Calif write-up (opens in a new tab), detector (opens in a new tab).

CVE-2026-86950: exploited Apple CoreGraphics zero-day

Sources

More from September 2026 patch cycle