Cybersecurity
Apple patches CoreGraphics flaw in iOS and macOS
Apple issued security updates for older iOS, iPadOS and macOS releases after finding a CoreGraphics flaw, which it said may have been used in targeted attacks and was reported by Meta Product Security.
- Apple released security updates for older iOS, iPadOS and macOS versions to address CVE-2026-86950 in CoreGraphics.
- Apple said the flaw could allow arbitrary code execution when a malicious file was processed.
- Apple said improved bounds checking fixed the issue and credited Meta Product Security with finding it.
- Apple said it had a report that the issue may have been exploited against specific targeted individuals on iOS versions before iOS 27, but it gave no details on scale, success or timing.
- The article said Apple had patched CVE-2026-20700 in dyld in February and that Apple said that bug had been weaponised in sophisticated cyber attacks.
Apple issued updates for iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 to fix CVE-2026-86950 in CoreGraphics. The fixes applied to the supported devices and Macs running those releases.
Apple said CVE-2026-86950 was an out-of-bounds write that could let an attacker run code when a malicious file was processed. It said improved bounds checking closed the flaw.
Meta Product Security found and reported the issue, according to Apple. Apple also said it had a report that the problem may have been used against specific targeted individuals on iOS versions before iOS 27.
The company did not say how many people were affected, whether any attempts worked, or when exploitation started. The article also said Apple had fixed a dyld memory corruption issue in February, CVE-2026-20700, and that Apple said it had been weaponised in cyber attacks.
Named in this story
Companies
- Apple
- released the security updates and made the exploitation claim
Organisations
- Meta Product Security
- discovered and reported the issue
Products and systems
- CoreGraphics
- the component affected by the flaw
- iOS
- one of the operating systems Apple said it updated
- iPadOS
- one of the operating systems Apple said it updated
- macOS Tahoe
- one of the macOS releases Apple patched
- macOS Sequoia
- one of the macOS releases Apple patched
- dyld
- the component Apple said had a separate memory corruption issue fixed in February
How the source tells it
The article is mostly a straight security notice, with a short alarmed note coming from Apple’s own description of possible targeted exploitation.
- alarm Apple’s quoted description of an extremely sophisticated attack against specific targeted individuals