VulnRadar

Data against noise.

Built with NaN
Page generated: 09 Nov 2026, 13:25 UTC
← Dashboard

CVE-2026-86950

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. App…

Read full description
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
CVSS 8.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
2.5/10
REALITY · THREAT PRIORITY
8.5/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 8.8: +1.32
  • Fresh EPSS: 26.17%: +0.13

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 31 documents and public datasets.

Hype components

Headline sample (25%)
30/100
Press, 30 days (60%)
30/100
Grounded branding (15%)
0/100
HYPE TOTAL26/100

Sources and documents

Rescana
Press · 28 Oct 2026, 06:52 · Apple CoreGraphics Zero-Day CVE-2026-86950: Fix Now Backported to Older iPhones and iPads - Rescana
The Hacker News
Press · 27 Oct 2026, 13:59 · Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
The Hacker News
Press · 27 Oct 2026, 13:59 · Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads - The Hacker News
"CVE-2026-86950" - Google News
Press · 27 Oct 2026, 11:49 · iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18 - SecurityWeek
Hong Kong Computer Emergency Response Team Coordination Centre
Press · 27 Oct 2026, 02:41 · Apple Products Multiple Vulnerabilities - Hong Kong Computer Emergency Response Team Coordination Centre
See all 31 source documents
Hacker News
Press · 25 Oct 2026, 08:34 · CVE-2026-86950: The Great Glyph Grift
shattered.io
Press · 06 Oct 2026, 14:18 · Apple’s CoreGraphics Zero-Day Hits CVSS 8.8 [2026] - shattered.io
https://tech-insider.org/
Press · 06 Oct 2026, 07:00 · Apple CoreGraphics Zero-Day CVE-2026-86950 Explained - https://tech-insider.org/
Help Net Security
Press · 04 Oct 2026, 07:00 · Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited - Help Net Security
cyberkendra.com
Press · 01 Oct 2026, 07:00 · CVE-2026-86950: The CoreGraphics Glyph Bug That Hit iPhones - cyberkendra.com
Bitdefender
Press · 01 Oct 2026, 07:00 · Apple patches zero-day behind ‘extremely sophisticated’ iPhone attacks - Bitdefender
The Hacker News
Press · 01 Oct 2026, 07:00 · Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path - The Hacker News
Security Affairs
Press · 01 Oct 2026, 07:00 · Public PoC Released for Apple CoreGraphics Zero-Day CVE-2026-86950 - Security Affairs
www.infosecurity-magazine.com
Press · 30 Sep 2026, 08:45 · Apple Patches CoreGraphics Zero Day Exploited in Attacks
Security Affairs
Press · 30 Sep 2026, 07:00 · U.S. CISA adds Apple Multiple Products flaw to its Known Exploited Vulnerabilities catalog - Security Affairs
SOCRadar
Press · 30 Sep 2026, 07:00 · CVE-2026-86950: Apple CoreGraphics Zero-Day - SOCRadar
cyberkendra.com
Press · 30 Sep 2026, 07:00 · Apple Patches CoreGraphics Zero-Day CVE-2026-86950 - cyberkendra.com
Computerworld
Press · 30 Sep 2026, 07:00 · Apple issues urgent iOS patch as it navigates the spyware arms race - Computerworld
Hong Kong Computer Emergency Response Team Coordination Centre
Press · 29 Sep 2026, 07:00 · Apple Products Remote Code Execution Vulnerability - Hong Kong Computer Emergency Response Team Coordination Centre
Cybernews
Press · 29 Sep 2026, 07:00 · Apple zero-day patch targets spyware-style attacks on older devices - Cybernews
Help Net Security
Press · 29 Sep 2026, 07:00 · Apple squashes zero-day bug exploited in "extremely sophisticated" attack (CVE-2026-86950) - Help Net Security
BetaNews
Press · 29 Sep 2026, 07:00 · Apple patches CoreGraphics flaw CVE-2026-86950 in iOS 26.7.1 - BetaNews
SecurityWeek
Press · 29 Sep 2026, 07:00 · Apple Patches Zero-Day Linked to ‘Extremely Sophisticated Attack’ - SecurityWeek
BleepingComputer
Press · 29 Sep 2026, 07:00 · Apple patches CoreGraphics zero-day flaw exploited in attacks - BleepingComputer
Dark Reading
Press · 29 Sep 2026, 07:00 · Apple Zero-Day Vulnerability Weaponized in Targeted Attacks - Dark Reading
Security Affairs
Press · 29 Sep 2026, 07:00 · Apple Patches CoreGraphics Zero-Day Linked to Sophisticated Targeted Attacks - Security Affairs
SOC Prime
Press · 29 Sep 2026, 07:00 · CVE-2026-86950: Apple CoreGraphics RCE Flaw - SOC Prime
The Register
Press · 29 Sep 2026, 07:00 · Apple patches CoreGraphics zero-day already exploited in targeted attacks - The Register
Pasquale Pillitteri
Press · 28 Sep 2026, 07:00 · Apple patches zero-day CVE-2026-86950, already used in targeted attacks - Pasquale Pillitteri
The Cyber Express
Press · 28 Sep 2026, 07:00 · Apple Fixes Exploited CVE-2026-86950 Flaw in iOS and iPadOS - The Cyber Express
The Hacker News
Press · 28 Sep 2026, 07:00 · Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks - The Hacker News

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

024681002 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 3.5Reality 8.504 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 3.1Reality 8.506 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 2.5Reality 8.5Nov 2Nov 4Nov 6

━ Hype Score (Perceived)  ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

3

Public exploit entries / repo candidates

See 3 repos with metrics
RepositoryStarsForksLanguageUpdated
java99999/CVE-2026-86950-POC10—29 Sep 2026, 09:00
jpdagostin0/CVE-2026-86950-POC10—20 Oct 2026, 22:49
DeAurity/CVE-2026-86950-POC00—29 Sep 2026, 09:00
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 8.8; EPSS 26.2%
Attention, last 30 days
6 distinct story titles; 6 press documents; 3 publisher domains.
Technical potential
network access, no prior privileges, user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-06 00:12:49.640935+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
28 Sep 2026, 07:00
Published
28 Sep 2026, 19:13
Added to the CISA KEV catalog
29 Sep 2026, 00:00
Latest press mention
28 Oct 2026, 06:52
Score calculated
06 Nov 2026, 00:12
PoCs on GitHub
3 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar