cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Apple Patches CoreGraphics Zero-Day Potentially Used in Targeted Attacks

· Original article ↗

Summary

Apple patched a CoreGraphics out-of-bounds write flaw that may have enabled arbitrary code execution in targeted attacks. Apple says attacks may have affected specific individuals on older iOS versions; fixes are available for iOS, iPadOS, and macOS.

Key points

  • CVE-2026-86950 is an out-of-bounds write in CoreGraphics that can allow arbitrary code execution when processing a specially crafted file.
  • Apple said it had received a report that the flaw may have been exploited in an extremely sophisticated attack against specific individuals on iOS versions before iOS 27.
  • Apple has not disclosed how the file was delivered or provided details about the attacks.
  • Apple credited Meta’s product security team with reporting the vulnerability; Meta said it routinely reports third-party vulnerabilities but did not clarify whether WhatsApp was involved.
  • Apple released fixes in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
  • Apple’s advisory suggests observed attacks targeted iOS; the article says the latest iOS 27 and macOS Golden Gate 27 do not appear affected.

Article Details

Vulnerability Types
  • Out-of-bounds write
Affected Versions
  • iOS versions before iOS 27
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1203 · Exploitation for Client ExecutionA specially crafted file processed by CoreGraphics can trigger arbitrary code execution; Apple said it was aware of a report of exploitation in targeted attacks.

CVE

CVE-2026-86950The flaw, tracked as CVE-2026-86950, is an out-of-bounds write issue in the CoreGraphics component that can be exploited for arbitrary code execution when it processes a specially crafted file.

Vendors

AppleApple on Monday released iOS and macOS updates to patch a zero-day vulnerability that may have been exploited in targeted attacks.MetaNo information has been shared on the attacks exploiting CVE-2026-86950, but Apple noted that it learned about the vulnerability from Meta’s product security team.

Products

iOSApple on Monday released iOS and macOS updates to patch a zero-day vulnerability that may have been exploited in targeted attacks.iPadOSCVE-2026-86950 has been patched with the release of iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.macOSApple on Monday released iOS and macOS updates to patch a zero-day vulnerability that may have been exploited in targeted attacks.

Related Articles