CoreGraphics (Product): news timeline & CVEs

Update your iPhone, iPad, or Mac: Flaw could run attackers’ code

Apple patched CVE-2026-86950, a CoreGraphics flaw possibly exploited in targeted iPhone attacks via malicious files.

Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that can let an attacker run code when a device processes a maliciously crafted file. Apple says it is aware of a report that the flaw may have been exploited in an extremely sophisticated, highly targeted attack against specific iPhone users on iOS versions before iOS 27. Fixes are in iOS and iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1, addressed with improved bounds checking.

Malwarebytes Labsupdated 14:30 UTC · 7h agofirst 10:35 UTC · 11h agoExploit / PoC in the wild 15 sources CVE-2026-86950

Apple patches CoreGraphics zero-day flaw exploited in attacks

Apple patched CoreGraphics zero-day CVE-2026-20700 after sophisticated targeted attacks on iOS devices.

Apple patched CVE-2026-20700, an out-of-bounds write in CoreGraphics reported by Meta Product Security. Processing a maliciously crafted file can lead to arbitrary code execution, and Apple said the issue may have been exploited in extremely sophisticated attacks against specific people on iOS versions before iOS 27. Updates cover iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 on recent iPhones, iPads, and Macs. The report calls it Apple's second in-the-wild zero-day of 2026, after a February dyld flaw it also labels CVE-2026-20700, and notes seven in-the-wild zero-days fixed in 2025.

BleepingComputer07:33 UTC · 14h agoExploit / PoC in the wildCVE-2026-20700 CVE-2025-24085 CVE-2025-24200+5 CVEs

APPLE-SA-09-28-2026-3 macOS Sequoia 15.8.1

Apple patched a CoreGraphics flaw in macOS Sequoia 15.8.1 that may allow code execution from a crafted file.

Apple Product Security published APPLE-SA-09-28-2026-3 for macOS Sequoia 15.8.1. The notice says a CoreGraphics issue could allow processing of a maliciously crafted file to lead to arbitrary code execution. It is listed with Apple's recent security updates. The posted text does not name a CVE or report exploitation.

Full Disclosureupdated 14:30 UTC · 7h agofirst 06:08 UTC · 15h agoVulnerability 15 sources

APPLE-SA-09-28-2026-2 macOS Tahoe 26.7.1

Apple patched a CoreGraphics flaw in macOS Tahoe 26.7.1 that may allow code execution from a crafted file.

Apple Product Security published APPLE-SA-09-28-2026-2 for macOS Tahoe 26.7.1. The advisory describes a CoreGraphics flaw where processing a maliciously crafted file may lead to arbitrary code execution. Apple lists the release among recent software updates with security fixes. The excerpt includes no CVE identifier and does not say the bug is exploited.

Full Disclosureupdated 14:30 UTC · 7h agofirst 06:08 UTC · 15h agoVulnerability 15 sources

APPLE-SA-09-28-2026-1 iOS 26.7.1 and iPadOS 26.7.1

Apple patched a CoreGraphics flaw in iOS 26.7.1 and iPadOS 26.7.1 that may allow code execution via a crafted file.

Apple Product Security published APPLE-SA-09-28-2026-1 for iOS 26.7.1 and iPadOS 26.7.1. The update is available for iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, and other listed iPads. CoreGraphics is affected: processing a maliciously crafted file may lead to arbitrary code execution. The posted notice does not cite a CVE or in-the-wild exploitation.

Full Disclosureupdated 14:30 UTC · 7h agofirst 06:08 UTC · 15h agoVulnerability 15 sources

Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks

Apple patched CoreGraphics CVE-2026-86950, which may have been exploited in targeted iOS attacks.

Apple released updates for an out-of-bounds write in CoreGraphics, CVE-2026-86950, that can allow arbitrary code execution when processing a malicious file. The company said it is aware of a report that the flaw may have been exploited in an extremely sophisticated attack against specific people on iOS versions before iOS 27. Fixes are in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1; Meta Product Security reported the bug. Apple previously patched a separate dyld issue, CVE-2026-20700, that it said was used in sophisticated attacks.

The Hacker Newsupdated 14:30 UTC · 7h agofirst Sep 28, 19:18 UTC · 1d agoExploit / PoC 15 sources CVE-2026-86950 CVE-2026-207006

CoreGraphics

Timeline6 articles

Related CVEsby mentions

Appears with

Update your iPhone, iPad, or Mac: Flaw could run attackers’ code

Apple patches CoreGraphics zero-day flaw exploited in attacks

APPLE-SA-09-28-2026-3 macOS Sequoia 15.8.1

APPLE-SA-09-28-2026-2 macOS Tahoe 26.7.1

APPLE-SA-09-28-2026-1 iOS 26.7.1 and iPadOS 26.7.1

Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks