Apple has released updates for older versions of iOS, iPadOS and macOS to fix a CoreGraphics vulnerability that it says may have been exploited in highly targeted attacks, The Hacker News reported Monday. The flaw, tracked as CVE-2026-86950, was found and reported by Meta's product security team.

What Happened

CVE-2026-86950 is an out-of-bounds write in CoreGraphics, the framework that handles 2D drawing and PDF rendering on Apple platforms. Processing a maliciously crafted file can let an attacker execute arbitrary code, and Apple said it resolved the issue with improved bounds checking.

The fix ships in iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Apple said it is aware of a report that the issue may have been exploited in an "extremely sophisticated attack" against specific targeted individuals running versions of iOS before iOS 27. SecurityWeek reported that iOS 27 and macOS Golden Gate 27 are not affected.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

Apple did not disclose how many people were targeted, whether the attacks succeeded or when exploitation began.

Why It Matters

The affected component is widely reachable. Because CoreGraphics renders images and documents across the operating system, SecurityWeek noted that a malicious file could arrive through web pages, email attachments or messaging apps, and that automatic previews of attachments and links could make zero-click exploitation possible. A flaw that fires when content is merely displayed is especially valuable to attackers, because the target does not have to open or tap anything.

Apple's phrasing about sophisticated attacks against specific individuals has typically accompanied exploitation linked to commercial spyware and other well-resourced operators, rather than broad criminal campaigns. That means most users are unlikely to have been targeted, but the patch closes an avenue that could be reused once details spread.

The report from Meta is also significant. SecurityWeek said the disclosure resembles an earlier case in which Meta's WhatsApp and an Apple ImageIO bug were involved in coordinated zero-click attacks. In August 2025 Apple patched an actively exploited ImageIO flaw, CVE-2025-43300, and WhatsApp separately disclosed that a bug in its own apps had been chained with it against a small number of users.

Earlier Fixes This Year

This is not Apple's first exploited vulnerability of 2026. In February the company patched CVE-2026-20700, a memory corruption flaw in the dyld dynamic linker with a CVSS score of 7.8. SecurityWeek said CVE-2026-86950 would be the ninth Apple vulnerability added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog this year. Listing in that catalog obliges U.S. federal civilian agencies to patch affected systems by a set deadline.

What to Watch

  • Users on iOS 26, iPadOS 26, macOS Tahoe or macOS Sequoia should install the new versions; upgrading to iOS 27 or macOS Golden Gate 27 also removes exposure.
  • Whether Meta, Apple or independent researchers publish technical details or attribution for the attacks.
  • Whether a companion flaw in a messaging app or another product is disclosed as part of the same exploit chain.
  • CISA's addition of the CVE to its Known Exploited Vulnerabilities catalog and the remediation deadline it sets for federal agencies.