Apple iOS and macOS out-of-bounds write allows arbitrary code execution via malicious file (CVE-2026-86950)

What happened

CVE-2026-86950 is an out-of-bounds write in Apple operating systems that can be triggered when a user processes a maliciously crafted file. Successful exploitation may lead to arbitrary code execution. The CVSS v3.1 score is 8.8 (high). The vector shows exploitation over the network with no privileges or authentication required, but user interaction is required and scope is unchanged.

Apple's advisory states that the company is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalogue. No public technical disclosure is recorded.

Who is affected

The affected products are iOS and iPadOS before 26.7.1, and macOS before 15.8.1 or before 26.7.1. This means iPhones and iPads that have not yet updated to iOS or iPadOS 26.7.1, and Macs running macOS Sequoia 15.x before 15.8.1 or macOS Tahoe 26.x before 26.7.1. These are end-user devices commonly used for email, messaging, documents and web browsing, where a malicious file can arrive through ordinary work.

What to do now

1. Apply Apple's updates. Install iOS or iPadOS 26.7.1 on every iPhone and iPad. On Macs, install macOS Sequoia 15.8.1 where the device is on a Sequoia 15.x release, and macOS Tahoe 26.7.1 where the device is on a Tahoe 26.x release.
2. Prioritise devices that process files from external or untrusted sources, and any devices still on versions of iOS before iOS 27, which Apple has identified as the target of reported exploitation.
3. Identify Macs by major version before patching. Updating the wrong major version will not remediate the issue. Use device management to confirm patch state across the estate.
4. No workaround has been published by Apple; patching is the remediation. CISA's due date for U.S. federal agencies is 2 October 2026 and may be a useful target for planning.

How to detect it

Apple has not published indicators of compromise for this issue, and no public technical disclosure is recorded. The most reliable detection step is patch-state verification: any iPhone, iPad or Mac still on an affected version is at risk. Because exploitation requires processing a crafted file, staff should report unexpected files or prompts rather than opening them.

Beyond the patch

Apple's advisory says this issue may have been exploited in targeted attacks, so post-breach detection and response is the immediate concern after patching. Our Managed Detection & Response watches for the kind of unusual behaviour that follows code execution on end-user devices, and our Incident Response Retainer ensures that if a crafted file was opened before patching, the resulting activity can be contained quickly.