Apple squashes zero-day bug exploited in “extremely sophisticated” attack (CVE-2026-86950)

Apple has released security patches addressing CVE-2026-86950, a zero-day vulnerability in the Core Graphics framework that was actively abused in a highly targeted attack against specific individuals running versions prior to iOS 27. The flaw, discovered by Meta Product Security, is an out-of-bounds write bug that lets attackers achieve arbitrary code execution once a device processes a specially crafted malicious file through Core Graphics, the component responsible for rendering graphics, images and PDFs on Apple's platforms. Fixes are included in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, while Apple's newest releases—iOS 27.0.1, iPadOS 27.0.1 and macOS Golden Gate 27.0.1—appear unaffected. Given the real-world exploitation and the sensitivity of the bug, all users are urged to install the update immediately.