Apple iOS and macOS Out-of-bounds Write Remote Code Execution Vulnerability (CVE-2026-86950) Security Advisory

Immediate patching is required as this vulnerability is actively exploited in the wild. ### 1. Apply OS Updates - iOS/iPadOS: Navigate to [Settings] > [General] > [Software Update] and install the latest available version (18.7.11, 26.7.1, or later). - macOS: Navigate to [System Settings] > [General] > [Software Update] to apply the latest security patches. ### 2. Temporary Mitigations - Exercise extreme caution when opening file attachments from unknown senders or downloading files from untrusted websites. - For high-risk individuals, consider enabling 'Lockdown Mode' to reduce the attack surface.

This vulnerability is an Out-of-bounds Write (CWE-787) issue within Apple's OS file processing components. It occurs due to insufficient bounds checking when the system parses specifically crafted files, allowing data to be written outside the allocated memory buffer. An attacker can leverage this memory corruption to overwrite critical system structures and hijack the execution flow, leading to arbitrary code execution (RCE). Notably, this is a confirmed zero-day vulnerability listed in the CISA KEV catalog, with reports indicating it has been actively exploited in highly sophisticated targeted attacks against specific individuals.