Apple исправила использовавшуюся в атаках 0-day-уязвимость в CoreGraphics

Apple has released security updates for iOS, iPadOS and macOS to fix a zero-day flaw tracked as CVE-2026-86950, which the company says may already have been exploited in highly targeted attacks against specific iPhone users. The bug, an out-of-bounds write in the CoreGraphics framework used for rendering images, graphics and text, could let a specially crafted malicious file trigger arbitrary code execution on an affected device; Apple fixed it by adding extra memory bounds checks. The issue was reported by Meta's Product Security team, and Apple's advisory notes the attacks affected devices running iOS versions up to iOS 27, without disclosing who was targeted, how many victims there were, or when exploitation began — language suggesting a narrow, not mass-scale, campaign. Fixes are included in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1; CISA added CVE-2026-86950 to its Known Exploited Vulnerabilities catalog on September 29, 2026, ordering US federal agencies to patch by October 2.