Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks
Summary
Apple patched CVE-2026-86950, a CoreGraphics out-of-bounds write that could enable code execution via a malicious file. Apple said it may have been exploited against targeted individuals but provided no details on successful attacks.
Key points
- CVE-2026-86950 is an out-of-bounds write in CoreGraphics that could allow arbitrary code execution when processing a maliciously crafted file.
- Apple said it was aware of a report that the flaw may have been exploited in a sophisticated attack against specific individuals using iOS versions before iOS 27.
- Apple did not say how many people were targeted, whether any attempts succeeded, or when exploitation may have begun.
- Apple addressed the issue with improved bounds checking and credited Meta Product Security with discovering and reporting it.
- Fixes are available in iOS 26.7.1 and iPadOS 26.7.1, and in macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
Article Details
- Vulnerability Types
- Out-of-bounds write
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
Vendors
Products
Core GraphicsApple has released security updates for older versions of iOS, iPadOS, and macOS to fix CVE-2026-86950, an out-of-bounds write in CoreGraphics that could enable arbitrary code execution.iOSApple has released security updates for older versions of iOS, iPadOS, and macOS to fix CVE-2026-86950, an out-of-bounds write in CoreGraphics that could enable arbitrary code execution.iPadOSApple has released security updates for older versions of iOS, iPadOS, and macOS to fix CVE-2026-86950, an out-of-bounds write in CoreGraphics that could enable arbitrary code execution.macOSApple has released security updates for older versions of iOS, iPadOS, and macOS to fix CVE-2026-86950, an out-of-bounds write in CoreGraphics that could enable arbitrary code execution.