Vulnerability details

CVE-2026-86950

Actively exploited

Apple iOS and iPadOSApple macOS

CVSS 3.1

8.8High

Official description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

CVSS scores

Score	Version	Source	Vector
8.8High	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Apple	iOS and iPadOS	v < 18.7.11	CVEProject cvelistV5 (CNA)
Apple	iOS and iPadOS	v < 26.7.1	CVEProject cvelistV5 (CNA)
Apple	macOS	v < 15.8.1	CVEProject cvelistV5 (CNA)
Apple	macOS	v < 26.7.1	CVEProject cvelistV5 (CNA)

References and advisories

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-28
Last updated: 2026-10-27
State: Published
Assigner (CNA): apple
Kolun priority: 88 · Critical

CISA KEV catalog

Date added: 2026-09-29
Due date: 2026-10-13
Used in ransomware: Unknown

Exploit prediction (EPSS)

26.16%

Probability of exploitation in 30 days

97.9%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Active
Technical impact: Total

Weaknesses (CWE)

CWE-787
Out-of-bounds Write