Out-of-Bounds Write in Apple CoreGraphics (CVE-2026-86950) Enables Arbitrary Code Execution Across iOS, macOS, iPadOS
What It Is — Apple’s CoreGraphics library in iOS, macOS, and iPadOS contains an out‑of‑bounds write flaw that can be leveraged for arbitrary code execution. The issue is tracked as CVE‑2026‑86950.
Exploitability — Listed in the CISA Known Exploited Vulnerabilities catalog; no public exploit code yet, but the vulnerability is trivially exploitable on‑device and could be weaponized in a drive‑by scenario. CVSS v3.1 base score 9.8 (Critical).
Affected Products — Apple iOS (all supported versions), macOS (all supported versions), iPadOS (all supported versions) that include the vulnerable CoreGraphics component.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability management and timely patch deployment – a core control objective that satisfies multiple frameworks (e.g., NIST CSF, ISO 27001).
- Provides audit‑ready evidence that your organization monitors vendor‑issued advisories and validates remediation, a prerequisite for defensible compliance reporting.
- Highlights the importance of maintaining an up‑to‑date software inventory to prove due diligence to regulators and enterprise partners.
Recommended Actions
- Verify current OS versions against Apple’s security advisory; apply the latest patches immediately.
- Update your asset inventory to flag any devices still running vulnerable CoreGraphics builds.
- Capture remediation evidence (patch logs, configuration snapshots) for audit trails.
- Enable continuous monitoring of Apple’s security bulletins through an automated feed.
Source: CISA KEV – CVE‑2026‑86950