Apple has pushed out emergency security updates for iPhones, iPads and Macs after fixing a vulnerability in CoreGraphics, the framework the company uses to render graphics and text across its operating systems. The flaw, tracked as CVE-2026-86950, is an out-of-bounds write bug that could let an attacker corrupt memory and potentially run their own code on a device simply by getting it to process a malicious file.
Apple said in its advisory that the issue “may have been exploited in an extremely sophisticated attack against specific targeted individuals” running versions of iOS before iOS 27. The company did not say how many people were affected, who was behind the attack, or how the malicious files were delivered. That kind of limited disclosure is typical for Apple when a flaw has been used in surveillance-style attacks against a small number of high-value targets, such as journalists, activists or government officials, rather than in a broad campaign aimed at ordinary users.
The vulnerability was found and reported to Apple by the Product Security team at Meta, the parent company of Facebook, Instagram and WhatsApp. Meta runs an internal security research group that regularly audits software its products depend on, including operating system components used by billions of devices that run its apps.
Patches are available now in iOS 26.7.1 and iPadOS 26.7.1, covering iPhone 11 and later models along with iPad Pro (3rd generation and newer), iPad Air (3rd generation and newer), iPad (8th generation and newer) and iPad mini (5th generation and newer). Mac users are covered by macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Apple said it fixed the bug through improved bounds checking, a standard technique for stopping a program from writing data past the edges of the memory it was allocated.
The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-86950 to its Known Exploited Vulnerabilities catalog on September 29, one day after Apple’s public disclosure, and gave federal civilian agencies until October 2 to apply the update. Inclusion in that catalog is reserved for vulnerabilities CISA has confirmed are being actively used in real attacks, and security teams outside government often treat it as a signal to prioritize patching quickly. Earlier this month, CISA added seven other actively exploited vulnerabilities to the same catalog in a single batch, two of which it rated at the maximum severity score; we covered that update at the time in our earlier report on that KEV batch.
This is the second zero-day vulnerability Apple has confirmed was exploited in the wild so far this year. The first, a flaw in the dyld dynamic linker tracked as CVE-2026-20700, was patched in February.
Apple has not said whether it plans to notify affected individuals directly, something the company has done in the past through its threat notification system for users it believes have been targeted by mercenary spyware. Users who want the update immediately can check for it under Settings, General, Software Update on iPhone and iPad, or through System Settings, General, Software Update on Mac.
Source: This report draws on reporting from The Hacker News, BleepingComputer and SecurityWeek.
