Apple has released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 to close an actively exploited zero-day vulnerability in the Core Graphics framework, tracked as CVE-2026-86950. The flaw, reported by Meta Product Security, allows arbitrary code execution when a device processes a maliciously crafted file, and Apple confirms it was used in highly targeted attacks against specific individuals.<\/p>\n
CVE-2026-86950 is an out-of-bounds write vulnerability inside Core Graphics, the Apple framework responsible for path-based drawing, transformations, color management, offscreen rendering, patterns, gradients and shadings, image data management, image creation, image masking, and PDF document creation, display, and parsing. When a device running a vulnerable operating system opens a maliciously crafted file, the flaw can be triggered to write outside the bounds of the intended memory area. That condition can be exploited to execute arbitrary code, letting an attacker run software of their choosing on the affected device.<\/p>\n
The vulnerability was reported by Meta Product Security. Apple’s advisory acknowledges that the issue was exploited in what it describes as an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. The company did not share additional details about the attacks, the targets, or the threat actor involved. The disclosure pattern, combining an out-of-bounds write in a media-handling framework with a small, named victim set, is consistent with spyware-grade operations that rely on convincing a target to open a single file.<\/p>\n
The fix ships in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. Apple’s newest operating system releases, iOS 27.0.1, iPadOS 27.0.1, and macOS Golden Gate 27.0.1, were published with no CVE-numbered vulnerabilities listed and do not appear to carry the same exposure. Devices that stay on older branches, including iOS 26 and earlier, iPadOS 26 and earlier, and the prior macOS lines, remain vulnerable until they are moved onto a patched build.<\/p>\n
Core Graphics is the layer the system uses to render images and parse PDF content across iOS, iPadOS, and macOS. A memory corruption bug in that framework is reachable any time a user opens an image or a PDF from Messages, Mail, Safari, or a third-party app that hands file rendering back to the system. Because the trigger is a crafted file rather than a network request, the user does not have to visit a malicious site or install unknown software for the exploit to fire; the file itself is the payload.<\/p>\n
Install iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, or macOS Sequoia 15.8.1 on every supported device as soon as the update is available. Devices that cannot move to a fixed build should avoid opening image or PDF attachments from unverified sources until a patch can be applied. Enterprises managing fleets should prioritize this update because the vulnerability was already being used in real attacks before a fix was public.<\/p>\n
CVE-2026-86950 is an out-of-bounds write vulnerability in Apple’s Core Graphics framework that allows arbitrary code execution when a device processes a maliciously crafted file. It was actively exploited in highly targeted attacks.<\/p>\n
The fix is included in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.<\/p>\n
No. iOS 27.0.1, iPadOS 27.0.1, and macOS Golden Gate 27.0.1 were released with no CVE-numbered vulnerabilities and do not appear to be affected by the flaw.<\/p>\n