Apple Patches Exploited CoreGraphics Zero-Day Affecting iOS, iPadOS, and macOS

Apple released emergency security updates on September 29, 2026, patching a zero-day vulnerability in CoreGraphics that was actively exploited in sophisticated targeted attacks against specific individuals.

The Vulnerability

CVE-2026-86950 is an out-of-bounds write in CoreGraphics that can lead to arbitrary code execution when the system processes a specially crafted file. The flaw affects:

• iOS 26.7 and earlier (patched in iOS 26.7.1)
• iPadOS 26.7 and earlier (patched in iPadOS 26.7.1)
• macOS Tahoe and macOS Sequoia (patched in macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1)

Targeted, Not Mass Exploitation

Apple's advisory states the vulnerability "may have been exploited in attacks against specific individuals." This is the language Apple uses for highly targeted spyware-style attacks — not broad malware campaigns affecting general users.

Meta Product Security discovered and reported the vulnerability to Apple. Meta's involvement is notable because the company has previously identified Apple vulnerabilities used in zero-click attacks against WhatsApp users. Last year, WhatsApp disclosed that CVE-2025-55177 was likely chained with Apple's ImageIO zero-day CVE-2025-43300 in attacks against fewer than 200 users.

There is no evidence the new CoreGraphics vulnerability was exploited through WhatsApp.

What Users Should Do

Update immediately if you are running affected versions:

• iPhone/iPad: Settings → General → Software Update → install iOS/iPadOS 26.7.1
• Mac: System Settings → General → Software Update → install macOS 26.7.1 or 15.8.1

Apple also patched older operating system branches rather than requiring users to upgrade to the latest major release — a meaningful choice for devices that cannot run the newest OS version.

Broader Security Context

The patch arrives during a week of intense AI safety discussions at the White House. While AI agents dominate headlines, traditional zero-day exploits against mobile operating systems remain a critical threat vector — especially for journalists, activists, and government officials targeted by commercial spyware.

CoreGraphics processes images and PDFs across the entire Apple ecosystem. A flaw in this framework is particularly dangerous because file formats like images are shared constantly through messaging apps, email, and web browsing — often without user interaction.

Takeaway

Even as the tech industry debates AI agent safety, foundational security work continues. Update your Apple devices. The exploit was real, targeted, and now patched — but only for users who install the fix.