1.0 Introduction
Recently, Apple released security updates to address a
remote code execution vulnerability (CVE-2026-86950) in Apple Products. The
flaw is an out-of-bounds write in CoreGraphics, Apple's graphics rendering
framework.
2.0 Impact
Successful exploitation of this vulnerability may allow an
attacker to execute arbitrary code on a vulnerable device when it processes a
maliciously crafted file. This may lead to unauthorised access to sensitive
information, installation of malware or spyware, and full device compromise.
Apple's advisory suggests that attacks have so far been observed only against
iOS, and only against specific targeted individuals. All unpatched devices
remain exposed if exploitation spreads.
3.0 Affected Products
- iPhone (iPhone 11 and later) and iPad models running iOS and iPadOS versions earlier than 26.7.1
- Mac computers running macOS Tahoe earlier than 26.7.1
- Mac computers running macOS Sequoia earlier than 15.8.1
- iOS 27, iPadOS 27 and macOS Golden Gate 27 do not appear to be affected
4.0 Recommendations
CyberSecurity Malaysia encourages users and administrators
to update to the latest software as soon as possible: iOS 26.7.1, iPadOS
26.7.1, macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1, or upgrade to version 27
where the device supports it.
Kindly refer to the following URL: https://support.apple.com/en-us/100100
Generally, we advise users to be updated with the latest
security announcements by the vendor and follow best practice security policies
to determine which updates should be applied.
For further enquiries, please contact Cyber999 Incident
Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References
- https://support.apple.com/en-us/100100
- https://support.apple.com/en-hk/149226
- https://support.apple.com/en-hk/149228
- https://support.apple.com/en-hk/149229
- https://www.cisa.gov/news-events/alerts/2026/09/29/cisa-adds-one-known-exploited-vulnerability-catalog