Apple has released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 to patch a CoreGraphics zero-day vulnerability, tracked as CVE-2026-86950, that the company says may have been exploited in highly targeted attacks against specific individuals. Apple credited Meta’s product security team for reporting the flaw, and the latest iOS 27 and macOS Golden Gate 27 releases do not appear to be affected.<\/p>\n
CVE-2026-86950 is an out-of-bounds write vulnerability in the CoreGraphics component that handles 2D graphics and PDF rendering across Apple’s operating systems. Processing a specially crafted file can trigger arbitrary code execution, which means a malicious file could run attacker-controlled code on the device.<\/p>\n
Because CoreGraphics underpins rendering across the OS, a malicious file could arrive through several channels, including web pages, email attachments, or messaging apps. Automatic attachment and link previews in those apps could enable zero-click exploitation, where the target does not need to interact with the file for the attack to succeed.<\/p>\n
Apple’s advisory states that the company is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. While both iOS and macOS are impacted, the advisory suggests that attacks have only been observed against iOS.<\/p>\n
Apple learned of the vulnerability from Meta’s product security team. In response to an inquiry, Meta said that, as part of its routine security work, it regularly reports vulnerabilities found in third-party software to other vendors so they can be patched. Meta did not provide information on the attacks exploiting CVE-2026-86950 or say whether WhatsApp was involved.<\/p>\n
The Meta involvement is notable in light of a similar incident from the previous year, when WhatsApp said a vulnerability in its iOS and macOS apps (CVE-2025-55177) was likely used alongside the Apple ImageIO zero-day CVE-2025-43300 in zero-click attacks aimed at fewer than 200 users. It is unclear whether the newly patched CoreGraphics flaw was exploited through WhatsApp.<\/p>\n
The flaw has been patched in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. The latest iOS 27 and macOS Golden Gate 27 do not appear to be affected.<\/p>\n
Users on iOS 26 and earlier releases, and on the affected macOS versions, should install the updates as soon as possible, especially those who may be at higher risk of targeted intrusion.<\/p>\n
CISA has not yet added CVE-2026-86950 to its Known Exploited Vulnerabilities catalog. If added, this would be the ninth Apple product flaw listed in the catalog this year.<\/p>\n
The pattern of a CoreGraphics-class flaw being reported by an outside security team and linked to highly targeted exploitation echoes earlier incidents. The prior year pairing of an Apple ImageIO zero-day (CVE-2025-43300) with a WhatsApp app flaw (CVE-2025-55177) showed that attackers can chain vulnerabilities across vendor boundaries to deliver zero-click payloads. CVE-2026-86950 fits that same family of risk: a widely used rendering component, a file as the trigger vector, and exploitation that Apple describes as extremely sophisticated against specific individuals.<\/p>\n
It is an out-of-bounds write vulnerability in the CoreGraphics component of iOS and macOS that can lead to arbitrary code execution when a specially crafted file is processed. Apple has patched it in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.<\/p>\n
Apple’s advisory says the company is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. No further details on the attacks have been shared, and CISA has not yet added the flaw to its Known Exploited Vulnerabilities catalog.<\/p>\n
Meta’s product security team reported the vulnerability to Apple. Meta said it regularly reports vulnerabilities found in third-party software to other vendors as part of routine security work, and did not confirm or deny whether WhatsApp was involved in any exploitation.<\/p>\n