CVE-2026-86950High· 8.8▾ Abyssal⚠ Exploited in the wild0dayPoC availableAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code exe…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 48.4 · likelihood 0.2 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Oct 13, 2026
0.8%
6 GitHub repos
Last analysed / modified upstream
0.8% → 26%
Added to the CISA catalog on Sep 29, 2026. Federal remediation due Oct 13, 2026. View catalog ↗
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
ipados < 26.7.1iphone_os < 26.7.1macos < 15.8.1macos >= 26.0, < 26.7.1Upgrade past the affected range:
ipados 26.7.1iphone_os 26.7.1macos 26.7.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84511High· 7.8An out-of-bounds write issue was addressed with improved bounds checking
CVE-2026-84546High· 8.4An out-of-bounds write issue was addressed with improved bounds checking
CVE-2026-86869Medium· 6.5An out-of-bounds write issue was addressed with improved bounds checking
CVE-2026-84531Medium· 6.2An out-of-bounds write issue was addressed with improved bounds checking
CVE-2026-84526Medium· 4.3An out-of-bounds write issue was addressed with improved bounds checking
CVE-2026-84552Medium· 5.5The issue was addressed with improved memory handling