GCVE-1988-2026-0401

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "iOS",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-28-2026-1 iOS 26.7.1 and iPadOS 26.7.1\n\niOS 26.7.1 and iPadOS 26.7.1 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149226.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nCoreGraphics\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted file may lead to arbitrary code\nexecution. Apple is aware of a report that this issue may have been\nexploited in an extremely sophisticated attack against specific targeted\nindividuals on versions of iOS before iOS 27.\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86950: Meta Product Security\n\nThis update is available through iTunes and Software Update on your iOS\ndevice, and will not appear in your computer's Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes from\nhttps://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple's update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is presented\nto the user when the iOS device is docked. We recommend applying the\nupdate immediately if possible. Selecting Don't Install will present the\noption the next time you connect your iOS device.\n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device.\n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About.\n* The version after applying this update will be \"iOS 26.7.1 and iPadOS\n26.7.1\".\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple's Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmq62rYACgkQ4Ifiq8DH\n7PVSthAAhRcLo1fmZS6vcpSPRNrXhkv6mf6tRi93Lmps8ltcrq9HjzjerrEpFt0M\nOy7yUy4RTmvfHw5BWaAupPqDlDnlp3+mEXM7aVayiCSXWBgww3CkqfyrHGoXPOsy\n3gBGHZg/7KIigFa1m3vaB4DXcpaNqOy02FjLajlaxUIm0T1qyJ4ifYkG4Dz8S+4E\nrf/XSL/TW3ZHPQmPRFk6EX53FKbAIGPpa3dKccEINVrH8UPxotQKKFGGitPQCXsY\nHWVzZ2+S0Uec0Nbmon3JP4DukBm1szs6nqfVTplIwkY0wyT5bOFBPylGb7WBfPWR\n5Dsqi1YSvZ2Fg0/4GsbVPUjgckQ5lpK22owTfBiUjQqBAJlE+QSZyBx0gSlXDnvG\nvhlletENEnv4Gpk2DjumNIXEFoAjj+TKzEuodWB0yhlYVHzLaXLgGlxY/PmpOst4\nLUtHySdshhaeIWTrLizGVB9MwEF5jwR2KP1XgpNdPvnmNoMhl7hRdAuULEOHYE6M\nABO9KyYzXomfr5Hf5O+Im7H9i9jcHyyg3+RGf+5Uh+GphskT5ydkuFLm18uvefAA\nu7mN5Ct0EH7emXXJXOXgu65L0punzGb4ev5bpribfCCBroY28BBayM4KUuLbKCoe\nqBIMH5kyZM+1NiMEbVHSSAEPtX+9/wY50Q8sx0Rdg9zuSwb/Ae0=\n=/ORp\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:32Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/89"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/89"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/149226"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/89"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-09-28-2026-1 iOS 26.7.1 and iPadOS 26.7.1",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-86950",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0401",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/89",
            "automated": true,
            "contentSha256": "51b0b4d36a9314e47a931fe964441b83b80e191e11bc6afddfec16f3d41b1afe",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/89",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-28T22:13:06Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:32Z",
    "dateUpdated": "2026-10-02T04:57:32Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0401"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}