Apple Patches CoreGraphics Zero-Day Reportedly Used in Targeted Attacks
Summary
Apple patched CVE-2026-20700, an out-of-bounds write in CoreGraphics that may have been exploited in sophisticated targeted attacks. Malicious files could trigger arbitrary code execution; Apple released updates for affected iPhones, iPads, and Macs.
Key points
- Apple says the flaw may have been exploited in sophisticated attacks against specific targeted individuals on iOS versions before iOS 27.
- CVE-2026-20700 is an out-of-bounds write in CoreGraphics; processing a maliciously crafted file may allow arbitrary code execution.
- Meta Product Security discovered the flaw, according to the article.
- Affected devices include iPhone 11 and later, specified iPad models, and Macs running macOS Sequoia 15.8.1 or Tahoe 26.7.1.
- Apple fixed the issue with improved bounds checking in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
- Apple recommends installing the security updates promptly. The article says the flaw is likely limited to highly targeted attacks.
Article Details
- Vulnerability Types
- Out-of-bounds write
- Affected Versions
- iOS versions before iOS 27
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Install the security updates for iOS, iPadOS, and macOS.
CVE
Vendors
Products
Core GraphicsApple released security updates to fix a zero-day in CoreGraphics that was reportedly used in extremely sophisticated attacks against targeted iOS users.iOSApple released security updates to fix a zero-day in CoreGraphics that was reportedly used in extremely sophisticated attacks against targeted iOS users.iPadOSThe flaw, tracked as CVE-2026-20700, affects a wide range of Apple devices and was patched with improved bounds checking in iOS, iPadOS, and macOS.macOSThe flaw, tracked as CVE-2026-20700, affects a wide range of Apple devices and was patched with improved bounds checking in iOS, iPadOS, and macOS.