Apple Patches Zero-Day Flaw Used in Targeted Attacks
Apple has released security updates for iPhone, iPad and Mac devices after identifying a CoreGraphics vulnerability that may have been exploited in an extremely sophisticated attack against specific individuals.
Apple has released security updates addressing a newly disclosed zero-day vulnerability, tracked as CVE-2026-86950, in its CoreGraphics component. Apple said the flaw could allow arbitrary code execution when a device processes a specially crafted file and acknowledged a report that it may have been exploited against targeted individuals using versions of iOS before iOS 27.
The vulnerability is described as an out-of-bounds write, a type of memory-handling error that can cause software to write information outside an allocated area. Apple fixed the problem through improved bounds checking. The company credited Meta Product Security with reporting the vulnerability, although Apple has not publicly disclosed details about the attacks or the individuals who may have been targeted.
Apple released iOS 26.7.1 and iPadOS 26.7.1 on September 28, covering iPhone 11 and newer models as well as several supported iPad generations. Matching security updates were also released for macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Apple says its latest iOS 27.0.1 release has no published CVE entries for this particular update.
Security researchers described the vulnerability as significant because Apple believes it was used in a highly sophisticated targeted attack rather than being merely a theoretical security weakness. Reports said the flaw could potentially be triggered through a maliciously crafted file, creating a pathway to execute code on an affected device. However, Apple has not provided enough public information to establish the full attack chain or identify the attackers.
Apple’s disclosure highlights the importance of keeping supported devices updated, particularly when a vulnerability has potentially been exploited before a fix became available. Users running older supported versions should install the relevant security update, while Apple continues to investigate the circumstances surrounding the attacks. The company generally withholds detailed information about security vulnerabilities until an investigation has been completed and patches are available.
