Apple releases patches for CoreGraphics vulnerability reportedly used in targeted attacks
Apple issued updates for iOS, iPadOS and macOS to fix CVE-2026-86950, an out-of-bounds write bug in CoreGraphics that may have been exploited in targeted attacks, with the flaw discovered by Meta Product Security.
Apple has rolled out security updates for older versions of iOS, iPadOS and macOS to fix a vulnerability identified as CVE-2026-86950. The flaw, an out-of-bounds write in the CoreGraphics component, could allow arbitrary code execution when a maliciously crafted file is processed. Apple said the issue was mitigated by adding stricter bounds checking and credited Meta Product Security for reporting the problem.
"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27," the company said.
Apple did not disclose how many users might have been affected, whether any attacks succeeded, or when the first exploitation occurred. The patches are available for iOS 26.7.1 and iPadOS 26.7.1 on supported iPhone and iPad models, as well as for macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
Earlier in February, Apple also released a fix for a memory-corruption issue in dyld (CVE-2026-20700) that had been weaponized in sophisticated cyber attacks.