Apple patches CoreGraphics zero-day linked to targeted pre-iOS 27 attacks

Apple has released security updates for iPhone, iPad and Mac to address CVE-2026-86950, a CoreGraphics vulnerability that can lead to arbitrary code execution when a specially crafted file is processed.

SecurityWeek reported that the flaw is an out-of-bounds write and that fixes are included in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.

Apple flags possible targeted exploitation

Apple said it is aware of a report that the issue may have been exploited in “an extremely sophisticated attack against specific targeted individuals” on versions of iOS before iOS 27, as quoted by SecurityWeek.

SecurityWeek also reported that Apple credited Meta’s product security team with reporting the vulnerability. The publication said it remains unclear whether the newly patched CoreGraphics flaw was exploited through WhatsApp.