Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks

Apple has pushed out fixes for a CoreGraphics bug, CVE-2026-86950, affecting older builds of iOS, iPadOS, and macOS, warning it may already have been abused in highly targeted attacks against specific individuals. The flaw is an out-of-bounds write that can trigger arbitrary code execution when a device opens a specially crafted file, and it was reported to Apple by Meta's Product Security team. Apple did not disclose how many victims were hit, whether any attacks succeeded, or when exploitation first began. The patch is included in iOS 26.7.1 and iPadOS 26.7.1 (iPhone 11 and newer, several iPad Pro/Air/mini models), macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, and follows a similar actively exploited dyld flaw (CVE-2026-20700) Apple patched back in February.