Apple has issued updates for iOS and macOS to address a critical zero-day vulnerability potentially exploited in targeted attacks. The flaw, identified as CVE-2026-86950, is an out-of-bounds write issue within the CoreGraphics component, making devices vulnerable to arbitrary code execution through specially crafted files.
Zero-Day Vulnerability Details
The vulnerability, CVE-2026-86950, affects Apple’s CoreGraphics component, which is integral to 2D graphics and PDF handling across its operating systems. While Apple has not specified the exact delivery method of the malicious files, potential vectors include web content, email attachments, or messaging applications that facilitate automatic previews, creating avenues for zero-click exploitation.
Apple acknowledged the sophisticated nature of the attack, which reportedly targeted specific individuals using older iOS versions prior to iOS 27. Although the company has not disclosed detailed information about the actual attacks, it confirmed that the vulnerability was reported by Meta’s product security team.
Meta’s Role and Previous Incidents
Meta’s involvement in identifying the vulnerability is significant, recalling a similar case last year where a vulnerability in WhatsApp was allegedly used alongside another Apple zero-day to execute zero-click attacks. These attacks were said to have affected fewer than 200 users. It remains unclear if the current CoreGraphics flaw was exploited via WhatsApp, as discussions with Meta are ongoing.
SecurityWeek has reached out to Meta for comments on this issue, and updates will be provided as more information becomes available. Meanwhile, Apple has urged users to install the latest updates to mitigate potential risks.
Response and Future Outlook
Apple addressed the vulnerability with the release of iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. While both iOS and macOS were susceptible, attacks have primarily impacted iOS users. Current versions, iOS 27 and macOS Golden Gate 27, reportedly remain unaffected.
The Cybersecurity and Infrastructure Security Agency (CISA) has yet to include CVE-2026-86950 in its Known Exploited Vulnerabilities (KEV) catalog, which would mark the ninth Apple-related entry this year. As cybersecurity threats evolve, continuous vigilance and timely software updates remain crucial for safeguarding digital assets.
Related articles discuss the broader scope of Apple’s recent security measures, including patching numerous vulnerabilities across its ecosystem, highlighting the company’s commitment to user safety and data protection.
