CVE-2026-86950: Apple CoreGraphics Zero-Day

An out-of-bounds write vulnerability (CWE-787) in Apple's CoreGraphics framework, scored 8.8 (high), allows arbitrary code execution when a device processes a maliciously crafted file, such as a malicious image or document that triggers the vulnerable rendering path. The flaw affects iPhones, iPads, and Macs, and exploitation requires no privileges but does require user interaction — the victim must open or preview the malicious file. Successful exploitation gives the attacker the ability to run code with high impact on confidentiality, integrity, and availability of the affected device. Apple states it is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27, indicating likely limited but real in-the-wild use. Fixes were shipped in iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1.

Do: Patch immediately to iOS 26.7.1 / iPadOS 26.7.1 on mobile and macOS Sequoia 15.8.1 or macOS Tahoe 26.7.1 on Macs; push these updates via MDM and verify fleet-wide compliance. Because the attack requires the victim to process a maliciously crafted file, advise users — especially journalists, activists, executives, and other likely targets of sophisticated attacks — not to open unsolicited attachments or media files from unknown senders. Review device logs and EDR telemetry for anomalous process activity following the opening of unexpected files on unpatched devices.