Apple patches CoreGraphics zero-day used against targeted iPhone users

Apple released emergency updates on Sept. 28 for a CoreGraphics vulnerability that it says may have been exploited against specific targeted individuals. The company said in its security notes that it is aware of a report that the bug may have been used in a highly sophisticated attack against people running versions of iOS before iOS 27.

The flaw, CVE-2026-86950, is an out-of-bounds write in the framework iPhones, iPads and Macs use to draw and process graphics. Processing a maliciously crafted file can lead to arbitrary code execution. Bugs reachable through file or image handling are attractive to spyware developers because content can arrive through messaging apps or email.

Who is affected

The fix is available in:

• iOS 26.7.1 and iPadOS 26.7.1, for iPhone 11 and later and supported iPads
• iOS and iPadOS 27.0.1
• macOS Tahoe 26.7.1, macOS Sequoia 15.8.1 and macOS 27.0.1
• watchOS 27.0.1 and visionOS 27.0.1

The Canadian Centre for Cyber Security listed the affected products in advisory AV26-971 on Sept. 29. CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day.

Apple credited Meta Product Security with reporting the bug. It has not said who was targeted, how the attack chain worked or whether commercial spyware was involved. Bitdefender noted that Apple had patched a separate ImageIO code execution bug, CVE-2026-65346, weeks earlier, though that one was not reported as exploited.

What to do

• On iPhone or iPad, open Settings, then General, then Software Update, and install the latest version.
• On a Mac, open System Settings, then General, then Software Update.
• Turn on automatic updates so future emergency fixes install without delay.
• Journalists, activists, executives and others at higher risk of targeted spyware should consider turning on Lockdown Mode.