Cybersecurity
Apple patches CoreGraphics zero-day in iOS attacks
Apple released security updates for CVE-2026-86950, a CoreGraphics out-of-bounds write flaw that it said may have been used in extremely sophisticated attacks on targeted iOS users.
- Apple released security updates for CVE-2026-86950 in CoreGraphics.
- Apple said the flaw may have been used in an extremely sophisticated attack against selected iOS users.
- Meta Product Security discovered the out-of-bounds write weakness.
- Apple said the issue could allow arbitrary code execution when a malicious file was processed.
Apple released security updates on Monday for CVE-2026-86950 after saying it had a report that the flaw may have been used against specific targeted individuals on iOS versions before iOS 27. It said the issue had been fixed in iOS 26.7.1 and iPadOS 26.7.1.
The weakness was an out-of-bounds write in CoreGraphics, the framework Apple uses for vector graphics, image rendering and text drawing across its operating systems. Apple said the problem was addressed with improved bounds checking.
Apple listed iPhone 11 and later, several iPad Pro, iPad Air, iPad, and iPad mini models, and Macs running macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1 as affected. It also named watchOS and tvOS as platforms that use CoreGraphics.
Named in this story
Companies
- Apple
- released the security updates and warned about possible exploitation
Organisations
- Meta Product Security
- discovered the CoreGraphics flaw
Products and systems
- CoreGraphics
- contained the out-of-bounds write weakness
- iOS
- was the platform Apple said the issue had affected
- iPadOS
- received an update that fixed the flaw
- macOS Sequoia 15.8.1
- was one of the Mac releases Apple patched
- macOS Tahoe 26.7.1
- was one of the Mac releases Apple patched
- iPhone 11 and later
- was among the affected device families
- iPad Pro 12.9-inch 3rd generation and later
- was among the affected device families
- iPad Pro 11-inch 1st generation and later
- was among the affected device families
- iPad Air 3rd generation and later
- was among the affected device families
- iPad 8th generation and later
- was among the affected device families
- iPad mini 5th generation and later
- was among the affected device families
- watchOS
- was named as one of the platforms using CoreGraphics
- tvOS
- was named as one of the platforms using CoreGraphics
How the source tells it
Mostly straight security reporting, with mild alarm and urgency introduced by Apple’s exploit warning and the push to install updates promptly.
- alarm a quoted warning that the flaw may have been used in an extremely sophisticated attack
- urgency an instruction to install the security updates promptly