Apple Patches CoreGraphics Zero-Day Exploited in Targeted Attacks

A malicious file could trigger arbitrary code execution

Apple has patched a CoreGraphics zero-day tracked as CVE-2026-86950. In its About the security content of iOS 26.7.1 and iPadOS 26.7.1 advisory, Apple says the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals.

The vulnerability is an out-of-bounds write issue in CoreGraphics. According to Apple, processing a maliciously crafted file could lead to arbitrary code execution. The company addressed the problem with improved bounds checking.

More Security and Technology News

Get cybersecurity alerts, gaming security news, and independent coverage from Fix Gaming Channel.

Apple says older iOS versions were targeted

The same Apple security advisory for iOS 26.7.1 and iPadOS 26.7.1 says the vulnerability may have been used in a highly sophisticated attack against specific individuals running versions of iOS older than iOS 27.

The company has not publicly identified the targets, the attackers, or the exact delivery method. BleepingComputer‘s report, “Apple patches CoreGraphics zero-day flaw exploited in attacks,” also describes the issue as a zero-day used in targeted attacks. The available reporting points to a limited campaign rather than broad mass exploitation.

Which Apple updates include the fix?

The fix is included in iOS 26.7.1 and iPadOS 26.7.1, released on September 28, 2026. Apple also documents the same CVE-2026-86950 issue in About the security content of macOS Sequoia 15.8.1.

The issue was credited to Meta Product Security.

What users should do

Users should update compatible iPhones, iPads, and Macs as soon as practical. On supported devices, the latest security update can be checked through the normal system software update menu.

The vulnerability is notable because malicious file processing is enough to trigger the flaw. That makes timely patching especially important for users who regularly receive files through email, messaging apps, cloud storage, or shared workspaces.

Apple CoreGraphics security advisory

CVE: CVE-2026-86950

Issue: Out-of-bounds write in CoreGraphics

Impact: Processing a maliciously crafted file may lead to arbitrary code execution

Fix: Install the latest compatible iOS, iPadOS, or macOS security update

Related Reading

WordPress 7.0.2 Emergency Update Fixes Critical Security Issue

Malicious Meccha Chameleon Workshop Maps Deliver Malware

Steam and Discord Scams Are Getting Smarter in 2026