Apple Patches CoreGraphics Out-of-Bounds Write Vulnerability (CVE-2026-86950)

Apple has addressed a memory safety flaw tracked as CVE-2026-86950, an Apple CoreGraphics vulnerability affecting iOS, iPadOS, and macOS devices. The flaw is an out-of-bounds write that allows remote attackers to achieve arbitrary code execution by tricking target devices into processing maliciously crafted image or vector graphics files. Because CoreGraphics handles low-level 2D rendering across the entire Apple ecosystem, the bug presents a system-wide attack surface.

Mechanics of the CoreGraphics Flaw

The underlying weakness is an out-of-bounds write (CWE-787) inside the CoreGraphics framework. When a vulnerable device parses a specifically formatted image, PDF, or rendered graphic asset, the library fails to properly validate memory boundaries, allowing input data to overwrite adjacent heap memory.

Because system components like Safari, Messages, Mail, and QuickLook rely directly on CoreGraphics for rendering content, processing a weaponized asset can lead to process memory corruption. Depending on the process context in which the image is rendered, an attacker can gain arbitrary code execution within the privileges of the calling application, frequently serving as the entry point for sandbox escape chains.

Risk Profile and Realistic Attack Paths

The CVSS v3.1 score for this vulnerability is 8.8, defined by the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. This vector highlights that the flaw is reachable over the network without prior authentication and involves low attack complexity. However, it requires user interaction—typically viewing a malicious web page, opening a crafted document, or receiving a file payload that triggers auto-preview rendering.

While the current EPSS score is 0.81% (55.3rd percentile), historical exploitation trends show that parsing vulnerabilities in Apple graphics and media frameworks are among the most heavily targeted flaw classes by commercial spyware vendors and advanced threat groups. Exploits targeting framework-level graphic engines are particularly attractive because they can be delivered quietly through standard web browsing, embedded email attachments, or messaging applications.

Affected Systems and Remediation

Security teams should prioritize updating all exposed Apple endpoints across mobile and desktop environments. The vulnerability affects iOS and iPadOS versions prior to 26.7.1, macOS versions prior to 15.8.1, and macOS 26.x releases prior to 26.7.1.

To mitigate this risk, apply the corresponding vendor updates immediately:

• iOS & iPadOS: Update devices to 26.7.1 or later.
• macOS: Update legacy builds to 15.8.1 or modern releases to 26.7.1 or later.

Organizations subject to CISA BOD 26-04 directives must ensure compliance and complete forensic triage assessments where applicable by the enforced October 2, 2026 deadline. Mobile Device Management (MDM) administrators should push OS updates to managed endpoints and enforce compliance policies to restrict unpatched devices from accessing enterprise resources.