CVE-2026-86950 · High · CISA KEV

Apple CoreGraphics Out-of-Bounds Write: Arbitrary Code Execution in KEV

Threat Engine Auto-Feed · data current as of 2026-09-29

An out-of-bounds write vulnerability in Apple's CoreGraphics, tracked as CVE-2026-86950, allows for arbitrary code execution. This flaw is actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog. Organizations using affected Apple products are at risk of significant compromise.

  • CVSS:
  • EPSS percentile: 0.55295
  • Exploitation pressure: 58/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 55th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

An out-of-bounds write occurs when a program attempts to write data beyond the allocated memory buffer. This can corrupt adjacent memory, leading to unpredictable behavior, crashes, or, in severe cases, allowing an attacker to execute their own malicious code.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations heavily reliant on Apple iOS, macOS, and iPadOS devices
  • Financial services organizations targeted by FIN7, LockBit affiliates, and APT38
  • Technology sector organizations targeted by APT29 and Scattered Spider

Misconfigurations that escalate it

    High-impact scenarios

    • Arbitrary code execution on user devices, leading to full system compromise.
    • Data exfiltration and espionage, particularly for high-value targets in finance and technology.
    • Ransomware deployment and other financially motivated attacks.

    Likely adversaries

    • FIN7 — Financial services (Assessed)
    • LockBit affiliates — Financial services (Assessed)
    • APT38 (Lazarus) — Financial services (Assessed)
    • APT29 (Cozy Bear) — Technology (Assessed)
    • Scattered Spider — Technology (Assessed)

    What to do (defensive)

    Detect

    • Monitor for unusual process activity originating from CoreGraphics or related system processes.
    • Implement endpoint detection and response (EDR) solutions to identify anomalous behavior on Apple devices.
    • Regularly review system logs for crashes or unexpected application terminations related to CoreGraphics.

    Contain

    • Isolate affected devices from the network to prevent lateral movement.
    • Block network communication to known malicious command-and-control (C2) infrastructure if identified.
    • Perform forensic analysis on potentially compromised devices to understand the extent of the breach.

    Patch

    • Apply vendor-provided security updates for Apple iOS, macOS, and iPadOS as soon as they become available.

    Frontier verdict — High

    High priority due to active exploitation (CISA KEV) and potential for arbitrary code execution across multiple Apple platforms.

    For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.