Apple patches CoreGraphics zero-day flaw exploited in attacks

Security researchers have published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw Apple says may have been used in attacks against specific targeted individuals. The trigger is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs. The code causes a crash, not an execution error. Turning the memory corruption into a working

Apple has patched CVE-2026-86950, a zero-day bug in the iOS CoreGraphics engine

Attackers are exploiting CVE-2026-86950, an out-of-bounds write flaw, in an extremely sophisticated fashion, according to Apple.

Apple has patched a CoreGraphics zero-day after warning that attackers may already have used the bug to compromise a small number of carefully chosen targets. The vulnerability, tracked as CVE-2026-86950, is an out-of-bounds write flaw in CoreGraphics, Apple's framework for handling graphics across its operating systems. According to Apple's advisory, processing a maliciously crafted file could allow an attacker to execute arbitrary code on a vulnerable device. The fruity vendor said it addressed the problem with improved bounds checking, though the bug appears to have made it out into the wild before Apple could squash it. "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27," the company said. As is customary when Cupertino encounters the sort of security bug somebody has apparently found useful, further details are thin on the ground. Apple didn't say who was targeted, how many people were affected, who was behind the attacks, or exactly how the vulnerability was being exploited. However, its choice of words suggests this wasn't a bug being exploited indiscriminately across the internet, and raises the possibility that it was used as part of a targeted spyware campaign. Meta Product Security reported CVE-2026-86950 to Apple, but neither Apple's advisory nor Meta has provided further technical details on how the flaw was discovered or the attacks in which it was allegedly used. The fix landed on Monday in iOS 26.7.1 and iPadOS 26.7.1. Apple lists affected devices receiving the update as the iPhone 11 and later, iPad Pro 12.9-inch (third generation and later), iPad Pro 11-inch (first generation and later), iPad Air (third generation and later), iPad (eighth generation and later), and iPad mini (fifth generation and later). Apple specifically says the attacks hit devices running versions of iOS before iOS 27, though it hasn't said exactly which older releases were targeted. The flaw adds another entry to Apple's growing collection of vulnerabilities caught being abused before users had a patch, with CVE-2026-86950 landing as the seventh zero-day fixed by the company this year. For anyone still running the affected releases, that leaves the usual less-than-thrilling security advice: install the update rather than waiting to find out exactly what an "extremely sophisticated attack" looks like. ®

Apple has released updates for iPhones, iPads, and Macs to fix a flaw that could let an attacker run code when a device processes a malicious file. Apple says it may have been used in highly targeted attacks against iPhone users running versions of iOS before iOS 27. The fix is in iOS and iPadOS 26.7.1, as well as macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1. Check Software Update on each of your Apple devices and install the latest version offered. Updates for your particular device The table below shows which relevant updates are available and links to Apple’s security information for each one. Update Available for iOS 26.7.1 and iPadOS 26.7.1 iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 macOS Tahoe macOS Sequoia 15.8.1 macOS Sequoia How to update your Apple devices How to update your iPhone or iPad To check if you’re using the latest software version, go to Settings > General > Software Update . You’ll see if an update is available and be guided through installing it. Turn on  Automatic Updates  if you haven’t already—you’ll find it on the same screen. Available update options on iPad How to update macOS on any version To update macOS on any supported Mac, use Software Update: Click the Apple menu in the upper-left corner of your screen. Choose  System Settings  (or  System Preferences  on older versions). Select  General  in the sidebar, then click  Software Update  on the right. On older macOS, look for  Software Update  directly. Your Mac will check for updates automatically. If updates are available, click  Update Now  (or  Upgrade Now  for major new versions) and follow the on-screen instructions. Before you upgrade to macOS Tahoe 26, read Apple’s  instructions . Enter your administrator password if prompted, then let your Mac finish the update. It may need to restart. Make sure your Mac stays plugged in and connected to the internet until the update is done. Technical details The bug, CVE-2026-86950 , affects CoreGraphics, an Apple framework used throughout its operating systems and apps to display and process visual content such as images and PDFs. It’s an out-of-bounds write issue, which Apple addressed with improved bounds checking. This type of bug happens when software writes data beyond the limits of its allocated area of memory. It can overwrite other data in memory, interfere with the normal operation of the program, cause a crash, or even let an attacker take control of the affected process. In this case, processing a maliciously crafted file may lead to an attacker running their own code. Apple says it is aware of a report that the issue may have been exploited in an “extremely sophisticated attack” against specific people using versions of iOS before iOS 27. Although the reported attack was highly targeted, other attackers could try to exploit the flaw now that it has been disclosed.  Scammers know more about you than you think.   Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.  Download for iOS →   Download for Android →  

Rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2026-86950 – già sanata dal vendor - che interessa i prodotti Apple iOS, iPadOS, macOS Tahoe e macOS Sequoia. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato l'esecuzione di codice arbitrario sui sistemi interessati.

Apple released security updates to fix a zero-day vulnerability exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]

Apple on Monday released iOS and macOS updates to patch a zero-day vulnerability that may have been exploited in targeted attacks. The flaw, tracked as CVE-2026-86950, is an out-of-bounds write issue in the CoreGraphics component that can be exploited for arbitrary code execution when it processes a specially crafted file. Apple has not said how the malicious file is delivered, but because CoreGraphics handles 2D graphics and PDF rendering across the operating system, it could arrive via web pages, email attachments, or messaging apps, where automatic attachment and link previews could enable zero-click exploitation. “Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27,” Apple said in its advisory. No information has been shared on the attacks exploiting CVE-2026-86950, but Apple noted that it learned about the vulnerability from Meta’s product security team. Meta’s involvement is noteworthy given a similar incident from last year, when WhatsApp said a vulnerability in its iOS and macOS apps (CVE-2025-55177) was likely used alongside the Apple ImageIO zero-day CVE-2025-43300 in zero-click attacks aimed at fewer than 200 users. It’s unclear whether the newly patched CoreGraphics flaw was exploited through WhatsApp. SecurityWeek has reached out to Meta for clarification and will update this article if the company responds. CVE-2026-86950 has been patched with the release of iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. While both iOS and macOS are impacted, Apple’s advisory suggests that attacks have only been observed against the former. The latest iOS 27 and macOS Golden Gate 27 do not appear to be affected. CISA has yet to add CVE-2026-86950 to its KEV catalog. This would be the ninth Apple product flaw added to the catalog this year. Related: Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe Related: Apple Patches Dozens of Vulnerabilities Across iOS, macOS, and Safari Related: Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug

Apple today released patches for all of its operating systems. However, only patches for older branches include a security fix. The vulnerability being addressed in iOS 26, macOS 26 and macOS 15 is already being exploited. iOS and macOS 27 are not affected. Today&#;x26;#;39;s update for the current "27" branch does not address security issues, but fixes some functional issues that got caught after the release two weeks ago. A 27.1 version was also expected to support the new foldable iPhone and will likely include specific features geared to the soon to be available device.

Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks. The vulnerability, tracked as CVE-2026-86950, refers to an out-of-bounds write impacting the CoreGraphics component that could lead to arbitrary code execution when processing a maliciously crafted file. The iPhone maker said the