CVE-2026-86950: Apple CoreGraphics Zero-Day

Apple released urgent security updates for CVE-2026-86950, a critical (CVSS 8.8) out-of-bounds write in the CoreGraphics framework that can enable arbitrary code execution when processing a specially crafted file. The flaw has been reported as exploited in targeted, sophisticated attacks against individuals running affected iOS versions, prompting Apple patches for iOS/iPadOS and macOS, inclusion in CISA’s Known Exploited Vulnerabilities catalog, and guidance to prioritize patching, restrict handling of untrusted files, hunt for suspicious crashes, and preserve forensic artifacts.