Apple patches CoreGraphics zero-day flaw exploited in attacks

Apple has released patches for a zero-day bug in CoreGraphics, the graphics and text-rendering framework shared across iOS, iPadOS, macOS, watchOS and tvOS, after confirming it was abused in highly targeted real-world attacks. The flaw, an out-of-bounds write weakness found by Meta Product Security, can let an attacker execute arbitrary code simply by getting a device to process a maliciously crafted file. Apple says it has reports of exploitation against specific individuals via what it calls an extremely sophisticated attack affecting iOS versions before iOS 27. Impacted hardware spans iPhone 11 and newer, several iPad Pro, Air, mini and standard models, plus Macs on macOS Sequoia and Tahoe; fixes are now available in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, and users are urged to update promptly even though the attacks appear narrowly targeted.