CVE-2026-86950

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.7.1 iPadOS versions prior to 26.7.1 macOS Sequoia versions prior to 15.8.1 macOS Tahoe versions prior to 26.7.1

Description An out-of-bounds write issue exists in the Apple CoreGraphics framework, which is used across Apple operating systems to display and process visual content such as images and PDFs. An out-of-bounds write occurs when software writes data beyond the limits of its allocated memory area, potentially overwriting other data or interfering with program operation. Processing a maliciously crafted file, specifically a PDF containing a crafted TrueType font, can trigger this memory corruption and lead to arbitrary code execution. This issue has been exploited in extremely sophisticated attacks targeting specific individuals on versions of iOS prior to iOS 27. There are indications that the vulnerability may be delivered via PDF preview mechanisms in messaging applications like WhatsApp.

Recommendations Update iOS to version 26.7.1 or later. Update iPadOS to version 26.7.1 or later. Update macOS Sequoia to version 15.8.1 or later. Update macOS Tahoe to version 26.7.1 or later. Enable Lockdown Mode for additional protection if you are a high-risk target for spyware.