Arbitrary Code Execution Risk in Apple CoreGraphics (CVE-2026-86950)

Catalog analysis: CISA added this entry on September 29, 2026. The entry reflects catalog information retrieved on September 29, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-86950 is an out-of-bounds write vulnerability (CWE-787) located within the CoreGraphics component of Apple’s operating systems. This flaw may enable an attacker to achieve arbitrary code execution on a target device. Because this vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of September 29, 2026, there is confirmed evidence that this flaw is being actively exploited in the wild.

Exposure and applicability

This vulnerability affects multiple Apple products, specifically those running iOS, macOS, and iPadOS. In a healthcare environment, these platforms are frequently utilized across various clinical and administrative functions, including:

• Mobile Health (mHealth) and Tablets: iPads and iPhones used by clinicians for accessing electronic protected health information (ePHI), reviewing patient charts, or managing medication administration.
• Administrative Workstations: macOS devices used by billing, scheduling, and healthcare administration staff to manage patient records.
• Clinical Engineering: Laptops used for the maintenance and configuration of networked medical devices.

Given that CoreGraphics is a fundamental framework for rendering images and PDFs, any device processing untrusted visual content could be at risk. The confirmed exploitation status increases the urgency for organizations managing these fleets to address the flaw.

Remediation priorities

Our analysis suggests prioritizing updates based on the device’s role in handling ePHI and its level of exposure to external data. We recommend the following prioritized actions:

1. Immediate Patch Deployment: Apply the vendor-provided security updates for iOS, macOS, and iPadOS across all managed devices. This is the primary control intended to prevent initial compromise by removing the underlying vulnerability.
2. Inventory Audit: Identify all unmanaged or “shadow IT” Apple devices operating within the clinical network that may not be receiving centralized updates.
3. Exposure Assessment: Prioritize patching for devices that frequently interact with external emails, third-party documents, or public-facing web content, as these are more likely vectors for triggering a CoreGraphics flaw.

How to validate remediation

To verify that the risk has been reduced, security leaders and IT administrators should employ the following methods:

• Version Verification: Use Mobile Device Management (MDM) tools or system reports to confirm that all devices are running the specific OS versions containing the fix for CVE-2026-86950.
• Compliance Reporting: Generate a fleet-wide report showing the percentage of patched versus unpatched assets to identify remaining gaps in coverage.

Note: A version check confirms the update was applied but does not guarantee that other configuration weaknesses are absent.

Limits and open questions

While patching addresses the known vulnerability, some residual risks remain. It is currently unknown if this flaw has been utilized in ransomware campaigns or specific targeted attacks against healthcare entities. Additionally, organizations may face challenges updating devices that are integrated with legacy medical software where vendor validation for the latest OS version is still pending. In such cases, coordination with clinical engineering and the device vendor is necessary to ensure patient safety and operational continuity.

Source and editorial note

CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability · Source date: September 29, 2026 · Retrieved September 29, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a healthcare security assessment