Apple patches CoreGraphics zero-day already exploited in targeted attacks
Meta-spotted flaw could hand attackers arbitrary code execution via a maliciously crafted file
Apple has released a security update to address a previously unknown vulnerability in its CoreGraphics framework, known as CVE-2026-86950. This flaw, an out-of-bounds write issue, could allow an attacker to execute arbitrary code on a victim's device by processing a specially crafted file. Apple's advisory indicates that the vulnerability may have been exploited in targeted attacks against specific individuals using older versions of iOS, prior to iOS 27.
The company has not disclosed the number of affected users, the identities of those targeted, or the motives behind the attacks. The fix, which improves bounds checking in CoreGraphics, was rolled out on Monday in iOS 26.7.1 and iPadOS 26.7.1. The update applies to a range of Apple devices, including iPhones released after the iPhone 11, iPad Pros, iPad Airs, iPads, and iPad Minis.
Despite the severity of the issue, Apple has not provided additional details on the exploit methodology or the specific older iOS versions targeted. As with previous instances of Apple being aware of vulnerabilities being abused before patches are released, users are advised to install the update promptly to mitigate potential risks.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
