CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-09-29. EPSS: 1.2% chance of exploitation in the next 30 days.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

Affected products

• Apple iPadOS: before 26.7.1 (fixed in 26.7.1)
• Apple iPhone OS: before 26.7.1 (fixed in 26.7.1)
• Apple macOS: before 15.8.1 (fixed in 15.8.1); from 26.0, before 26.7.1 (fixed in 26.7.1)

Published 2026-09-28. Last modified 2026-10-01.