A name on the page is not a finished check

Write only what the page says

The page's claim is: Apple advisory for iOS 26.7.1 and iPadOS 26.7.1 dated September 28, 2026 documents CVE-2026-86950, an out-of-bounds write in CoreGraphics. Apple says processing a maliciously crafted file may lead to arbitrary code execution and that it is aware of a report the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. Credit: Meta Product Security. Companion macOS advisories were opened by teammates.

Put the URL under that sentence. If a later recap adds a number or a date, keep the original page as the record.

One row per name. Leave the result cell empty until you have an action you could fail.

Do the site's check on this one page. Fill a line only when the page supports it. Where the page is silent, write Not stated.

A finished note names the page, the date, and the limit of the claim. It does not borrow a result from a different story.

Stop at the untested line

Anything you did not open, install, or count stays untested. Leave that line visible.

Source page: Apple patches exploited CoreGraphics out-of-bounds write CVE-2026-86950.

Sources: Apple patches exploited CoreGraphics out-of-bounds write CVE-2026-86950

Related guides

• A name on the page is not a finished check
• A name on the page is not a finished check
• A name on the page is not a finished check

Primary references

• Apple patches exploited CoreGraphics out-of-bounds write CVE-2026-86950