Apple Patches Zero-Day Exploit in Sophisticated Attack (CVE-2026-86950)

Apple has released security patches to resolve a critical flaw (CVE-2026-86950) in the Core Graphics framework, which was actively exploited in advanced attacks targeting specific iOS users.

Apple Addresses Actively Exploited Zero-Day Vulnerability

Apple confirmed awareness of reports indicating that the vulnerability (CVE-2026-86950) in the Core Graphics framework was leveraged in highly advanced attacks. The flaw affects iOS versions prior to iOS 27, though details about the affected parties or attack methods remain undisclosed.

Vulnerability Details

The Core Graphics framework handles critical functions such as path rendering, color calibration, offscreen visualization, pattern generation, gradient application, image handling, and PDF file processing. The vulnerability, identified by Meta Product Security, involves an out-of-bounds write flaw that enables unauthorized code execution when malicious files are processed.

Patches and Affected Systems

Patches for the issue are included in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. However, Apple’s latest updates—iOS 27.0.1, iPadOS 27.0.1, and macOS Golden Gate 27.0.1—do not carry published CVE identifiers for this specific flaw. All users are advised to apply the latest security updates promptly.

Additional Security Developments

Apple has introduced enhanced fraud detection features in iOS 27, expanded parental control options for web browsing, and new photo verification tools tailored for high-risk user groups. These updates highlight the company’s ongoing focus on user security and privacy.

Conclusion

Users are urged to prioritize system updates to mitigate risks associated with unpatched systems. The incident emphasizes the critical role of proactive security measures in safeguarding against advanced threats.

About Author

Anuj

See author's posts