Zero Radar
← feed
CriticalVulnerabilityCVE-2026-86950updated 27 Oct 2026, 16:36 UTC

Apple iPhone, iPad and Mac can be hijacked by a malicious file

A specially crafted file can make an Apple device run an attacker's code without the user doing much. Apple reports this was used in very targeted attacks against specific people.

Exploited (CISA KEV, NVD)Fix availableOfficial, 8 sources
SeverityCriticalCVSS 8.8 of 10
Being exploited?YesConfirmed by CISA KEV, NVD, BleepingComputer, SecurityWeek · 29 Sept 202
Fix available?YesiOS 26.7.1, iPadOS 26.7.1, iOS 18.7.11, iPadOS 18.7.11, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1; iOS 27.2 and iPadOS 27.2 also include the fix. · since 25 Oct 2026
How sure is this?Official, 8 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts fileFile is built to exploit the flaw
  2. 2Victim opens fileProcessed by CoreGraphics on the device
  3. 3Memory overwrittenOut-of-bounds write corrupts memory
  4. 4Code runsAttacker gains code execution
  5. ResultAttacker controls the device

What happened

An out-of-bounds write flaw in Apple's CoreGraphics graphics component lets processing of a maliciously crafted file lead to arbitrary code execution.

Why it is dangerous: Successful exploitation gives an attacker control over the device, which is especially risky for individuals targeted in sophisticated attacks and for organizations with Apple devices.

Are you affected?

You are affected if you run iOS or iPadOS versions before 26.7.1 (or 18.7.11 for older devices), or macOS Sequoia before 15.8.1 or macOS Tahoe before 26.7.1.

iOS and iPadOS before 26.7.1; iOS and iPadOS 18 before 18.7.11; macOS Sequoia before 15.8.1; macOS Tahoe before 26.7.1; iOS versions before iOS 27 per Apple's exploitation report.

What to do

  1. Update iPhone and iPad to iOS or iPadOS 26.7.1, or 18.7.11 for older devices, or to 27.2 or later
  2. Update Mac to macOS Sequoia 15.8.1 or macOS Tahoe 26.7.1 or later
  3. Prioritize devices used by high-risk individuals and check internet-facing assets for patch status

Timeline

  1. 28 Sept 2026, 20:17 UTC
    Publicly disclosed
  2. 29 Sept 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 25 Oct 2026, 17:35 UTC
    Fix: iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1
  5. 26 Oct 2026, 21:29 UTC
    NVD reported on it · NVD
  6. 27 Oct 2026, 10:41 UTC
    BleepingComputer reported on it · BleepingComputer
  7. 27 Oct 2026, 11:58 UTC
    Full Disclosure reported on it · Full Disclosure
  8. 27 Oct 2026, 12:43 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)
  9. 27 Oct 2026, 13:17 UTC
    SecurityWeek reported on it · SecurityWeek
  10. 27 Oct 2026, 13:17 UTC
    Full Disclosure reported on it · Full Disclosure
  11. 27 Oct 2026, 13:17 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)
  12. 27 Oct 2026, 16:36 UTC
    The Hacker News reported on it · The Hacker News

Sources 8 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Security press established security newsrooms

Technical details

ID
CVE-2026-86950 · GHSA-3cf3-h799-fjvq · ZR-18137863 · ZR-c99aa3fd · ZR-884b52d7
CVSS
8.8 / 10
EPSS
26% chance of exploitation within 30 days
Disclosed
28 Sept 2026, 20:17 UTC
On Zero Radar
before the radar started
Last change
27 Oct 2026, 16:36 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Apple iPhone, iPad and Mac can be hijacked by a malicious file · Zero Radar