Apple Patches CoreGraphics Zero-Day Exploited in Targeted Attacks

• •CVE-2026-86950 is a critical out-of-bounds write vulnerability in Apple's CoreGraphics framework.
• •The flaw has been exploited in targeted attacks against specific individuals using older iOS versions.
• •Users are urged to update to iOS 26.7.1, iPadOS 26.7.1, and macOS Tahoe 26.7.1 to mitigate the risk.

Apple has released emergency updates for iOS, iPadOS, and macOS to address a critical zero-day vulnerability, CVE-2026-86950, in its CoreGraphics framework. This out-of-bounds write flaw can allow arbitrary code execution when a device processes a maliciously crafted file. The vulnerability was reportedly exploited in highly sophisticated attacks against specific individuals using versions of iOS prior to iOS 27. Meta Product Security reported the issue to Apple, which has not disclosed details about the targeted individuals or the attack methods used. The flaw affects a range of devices, including iPhone 11 and later, and various iPad models. Apple released patches on September 28, 2026, and users are urged to update their devices immediately. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, emphasizing the urgency of the situation.