cyber.hendryadrian.com
Vulnerability & Exploit · helpnetsecurity.com

Apple patches actively exploited Core Graphics zero-day

· Original article ↗

Summary

Apple patched CVE-2026-86950, an actively exploited out-of-bounds write in Core Graphics that could allow code execution via a malicious file. Apple says attacks may have targeted specific individuals; fixes are available for listed iOS, iPadOS, and macOS versions.

Key points

  • CVE-2026-86950 is an out-of-bounds write in Apple’s Core Graphics framework.
  • Processing a maliciously crafted file could trigger arbitrary code execution.
  • Apple said the flaw may have been exploited in a sophisticated attack against specific individuals on iOS versions before iOS 27; it provided no further attack or target details.
  • Meta Product Security reported the vulnerability to Apple.
  • Fixes are available in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
  • The article says iOS 27.0.1, iPadOS 27.0.1, and macOS Golden Gate 27.0.1 do not appear to be affected.

Article Details

Vulnerability Types
  • Out-of-bounds write
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1203 · Exploitation for Client ExecutionProcessing a maliciously crafted file on a vulnerable OS could trigger arbitrary code execution.

CVE

CVE-2026-86950Apple has released security updates for iOS and macOS to address CVE-2026-86950, an actively exploited zero-day in the Core Graphics framework.

Vendors

AppleApple has released security updates for iOS and macOS to address CVE-2026-86950, an actively exploited zero-day in the Core Graphics framework.

Products

Core GraphicsApple has released security updates for iOS and macOS to address CVE-2026-86950, an actively exploited zero-day in the Core Graphics framework.iOSApple has released security updates for iOS and macOS to address CVE-2026-86950, an actively exploited zero-day in the Core Graphics framework.iPadOSFixes are available in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.macOSApple has released security updates for iOS and macOS to address CVE-2026-86950, an actively exploited zero-day in the Core Graphics framework.

Related Articles