CVE-2026-86950 – Apple iOS and iPadOS
“One crafted file is all it takes, and attackers are already using it. Every unpatched iPhone is an open door.”
Apple's iOS and iPadOS update fixes six vulnerabilities, five Critical and one High. Attackers are actively exploiting CVE-2026-86950, an out-of-bounds write that lets a maliciously crafted file run arbitrary code. Apple reports its use in an extremely sophisticated attack against specific targeted individuals. The fix ships in iOS 26.7.1 and iPadOS 26.7.1, along with macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1. CVE-2026-86950 has a CVSS score of 8.8, High severity.
The rest of the update closes memory corruption, permissions, and certificate validation flaws. These fixes also reach macOS, tvOS, visionOS, and watchOS. CVE-2026-65414 has a CVSS score of 9.8, Critical severity: an out-of-bounds write that lets a remote attacker terminate apps or run arbitrary code. CVE-2026-84561 has a CVSS score of 9.8, Critical severity: a double free that lets an app corrupt kernel memory. CVE-2026-84609 has a CVSS score of 9.8, Critical severity: it lets an app modify protected system files. CVE-2026-84625 has a CVSS score of 9.1, Critical severity: it lets an app fingerprint the user. CVE-2026-86881 has a CVSS score of 9.1, Critical severity: it lets an attacker who holds a compromised intermediate certificate authority issue certificates with arbitrary extended key usages.
Key Details
- Affected Product
- Apple Ipados
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- CWE Classification
- CWE-787