cyber.hendryadrian.com
Vulnerability & Exploit · darkreading.com

Apple Patches Actively Exploited Zero-Day in Targeted Attacks

· Original article ↗

Summary

Apple patched an actively exploited CoreGraphics zero-day affecting iOS and macOS. CISA added it to its KEV catalog, while Apple has not disclosed who is behind the targeted attacks.

Key points

  • CVE-2026-86950 is an out-of-bounds write in Apple's CoreGraphics framework that can allow arbitrary code execution.
  • Apple says the flaw was exploited in highly sophisticated attacks against specific individuals.
  • The vulnerability affects iOS and macOS; Apple released updates for affected versions, including macOS Tahoe and Sequoia.
  • CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and set a three-day remediation deadline for federal civilian agencies.
  • Apple credited Meta with reporting the flaw but has not identified the attackers or disclosed details about the exploit activity.
  • The article recommends promptly patching Apple devices and enforcing managed-device update and compliance policies.

Article Details

Vulnerability Types
  • Out-of-bounds write
  • Memory corruption
Severity
CVSS 8.8
Affected Versions
  • iOS versions before iOS 27
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2025-43300pointed to CVE-2025-55177, a vulnerability in WhatsApp that attackers exploited in combination with CVE-2025-43300, another out-of-bounds zero-day vulnerability, this time in Apple's ImageIQ technology.CVE-2025-55177look for routes through components that process untrusted content." As an example, he pointed to CVE-2025-55177, a vulnerability in WhatsApp that attackers exploited in combination with CVE-2025-43300, anotherCVE-2026-86950The out-of-bounds write vulnerability, tracked as CVE-2026-86950, affects Apple's CoreGraphics framework, which macOS and iOS use to render and manipulate 2D graphics. The vulnerability affects a broad range of Apple

People

Adam ByntonEnterprise security manager at Jamf; commented on the vulnerability and related Apple exploitation patterns.Ensar SekerChief information security officer at SOCRadar; discussed the potential implications of the vulnerability.

Malware

PegasusWhatsApp, for instance, has previously accused Israel's NSO Group of using its servers to distribute its Pegasus spyware on mobile devices belonging to targeted individuals.

Vendors

AppleApple released new versions of iOS and macOS to address a zero-day vulnerability that a threat actor is actively exploiting in targeted attacks.MetaApple credited Meta with disclosing the vulnerability to the company but has not released any information on the exploit activity or who it might be targeting.

Products

CoreGraphicsThe out-of-bounds write vulnerability, tracked as CVE-2026-86950, affects Apple's CoreGraphics framework, which macOS and iOS use to render and manipulate 2D graphics. The vulnerability affects a broad range of AppleImageIQin combination with CVE-2025-43300, another out-of-bounds zero-day vulnerability, this time in Apple's ImageIQ technology.iOSApple released new versions of iOS and macOS to address a zero-day vulnerability that a threat actor is actively exploiting in targeted attacks.macOSApple released new versions of iOS and macOS to address a zero-day vulnerability that a threat actor is actively exploiting in targeted attacks.macOS TahoeThough Apple has only referenced the attacks as targeting iOS, the company has patched the same flaw in macOS Tahoe and Sequoia, Boynton points out.SequoiaThough Apple has only referenced the attacks as targeting iOS, the company has patched the same flaw in macOS Tahoe and Sequoia, Boynton points out.WhatsAppthat process untrusted content." As an example, he pointed to CVE-2025-55177, a vulnerability in WhatsApp that attackers exploited in combination with CVE-2025-43300, another out-of-bounds zero-day

Related Articles