cyber.hendryadrian.com
Vulnerability & Exploit · malwarebytes.com

Apple Patches CoreGraphics Flaw Reportedly Used in Targeted iPhone Attacks

· Original article ↗

Summary

Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that could allow code execution from a malicious file. Apple says it may have been exploited in highly targeted attacks against iPhones running iOS versions before iOS 27.

Key points

  • CVE-2026-86950 affects CoreGraphics, which processes visual content such as images and PDFs.
  • Processing a specially crafted malicious file could trigger an out-of-bounds write and allow an attacker to run code.
  • Apple says it is aware of a report that the flaw may have been used in highly targeted attacks against people using iOS versions before iOS 27.
  • Apple fixed the issue with improved bounds checking.
  • Fixes are available in iOS and iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1.
  • Users should check Software Update and install the latest version offered for their device.

Article Details

Vulnerability Types
  • Out-of-bounds write
Affected Versions
  • iOS versions before iOS 27
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1203 · Exploitation for Client ExecutionProcessing a maliciously crafted file may exploit the CoreGraphics flaw to run attacker code; Apple says the issue may have been exploited in highly targeted attacks against specific iPhone users.

CVE

CVE-2026-86950The bug, CVE-2026-86950, affects CoreGraphics, an Apple framework used throughout its operating systems and apps to display and process visual content such as images and PDFs.

Vendors

AppleApple has released updates for iPhones, iPads, and Macs to fix a flaw that could let an attacker run code when a device processes a malicious file.

Products

CoreGraphicsThe bug, CVE-2026-86950, affects CoreGraphics, an Apple framework used throughout its operating systems and apps to display and process visual content such as images and PDFs.iOSApple says it may have been used in highly targeted attacks against iPhone users running versions of iOS before iOS 27.iPadOSThe fix is in iOS and iPadOS 26.7.1, as well as macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1.macOS SequoiaThe fix is in iOS and iPadOS 26.7.1, as well as macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1.macOS TahoeThe fix is in iOS and iPadOS 26.7.1, as well as macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1.

Related Articles