Apple squashes zero-day bug exploited in “extremely sophisticated” attack (CVE-2026-86950)

Apple has shipped iOS and macOS security updates to fix an actively exploited zero-day vulnerability (CVE-2026-86950) in the operating systems’ Core Graphics framework.

“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27,” the company said, but refrained from providing additional details about the attacks or targets.

About CVE-2026-86950

Core Graphics handles “path-based drawing, transformations, color management, offscreen rendering, patterns, gradients and shadings, image data management, image creation, and image masking, as well as PDF document creation, display, and parsing.”

Reported by Meta Product Security, CVE-2026-86950 is an out-of-bounds write issue that allows for arbitrary code execution when a vulnerable OS processes a maliciously crafted file.

A fix for the flaw is included in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.

Apple’s latest operating systems – iOS 27.0.1, iPadOS 27.0.1, and macOS Golden Gate 27.0.1 don’t appear to be affected: those updates were shipped with no published CVE-numbered vulnerabilities.

Nevertheless, all users should upgrade to a fixed version as soon as possible.

In Apple-related news:

Apple’s new iOS 27 feature looks for signs you’re being scammed
Apple parental controls in iOS 27 let kids ask before opening new websites
Apple is building photo verification for the people who need it most

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!