INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Apple Patches CoreGraphics Zero Day Exploited in Sophisticated Targeted Attacks

| 2026-09-29 06:18 CRITICAL MEDIUM EXPLOITED VULNERABILITY VULNERABILITY DISCLOSURE
JSON
Executive Summary
AI-generated
On September 28, Apple attributed the discovery of CVE-2026-86950 to its Meta Product Security team. The vulnerability affects a broad range of Apple devices, including iPhones dating back to the iPhone 11 and multiple generations of iPads, as well as Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1. According to reports, this zero-day was exploited in an "extremely sophisticated attack against specific targeted individuals" on versions of iOS before iOS 27, with Apple stating that processing a maliciously crafted file may lead to arbitrary code execution. The vulnerability has been fixed in the latest software updates for affected devices.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2025-43529, CVE-2025-55177 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
sa•••••.organizations
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2025-43529CVE-2025-43529 CVE-2025-55177CVE-2025-55177 CVE-2025-14174CVE-2025-14174 CVE-2025-20701CVE-2025-20701 CVE-2026-86869CVE-2026-86869 CVE-2025-24200CVE-2025-24200 CVE-2025-31200CVE-2025-31200 CVE-2025-31201CVE-2025-31201 CVE-2026-86950CVE-2026-86950 CVE-2025-43300CVE-2025-43300 CVE-2025-24085CVE-2025-24085 CVE-2025-24201CVE-2025-24201 CVE-2026-20700CVE-2026-20700
Target & Sectors
IL
Incident Timeline
‎February 2025
Researchers at The Citizen Lab discovered and reported the CVE-2025-24200 CoreGraphics zero-day vulnerability, which was allegedly exploited in a targeted attack against an individual.
organisation CVE-2025-24200
In February 2025, for example, researchers at The Citizen Lab found CVE-2025-24200, which Apple said had been exploited “in an extremely sophisticated attack against specific targeted individual.”
organisation The Citizen Lab
In February 2025, for example, researchers at The Citizen Lab found CVE-2025-24200, which Apple said had been exploited “in an extremely sophisticated attack against specific targeted individual.”
‎2025/09/29
Threat actors used the Apple ImageIO zero-day vulnerability (CVE-2025-43300) in conjunction with a previously disclosed WhatsApp iOS and macOS app vulnerability (CVE-2025-55177) to carry out zero-click attacks targeting fewer than 200 users.
infrastructure Ios
Meta’s involvement is noteworthy given a similar incident from last year, when WhatsApp said a vulnerability in its iOS and macOS apps (CVE-2025-55177) was likely used alongside the Apple ImageIO zero-day CVE-2025-43300 in zero-click attacks aimed at fewer than 200 users.
Last year, WhatsApp disclosed that a vulnerability in its iOS and macOS applications, tracked as CVE-2025-55177 , was likely chained with Apple’s ImageIO zero-day CVE-2025-43300 in zero-click attacks against fewer than 200 users.
infrastructure Macos
Meta’s involvement is noteworthy given a similar incident from last year, when WhatsApp said a vulnerability in its iOS and macOS apps (CVE-2025-55177) was likely used alongside the Apple ImageIO zero-day CVE-2025-43300 in zero-click attacks aimed at fewer than 200 users.
Last year, WhatsApp disclosed that a vulnerability in its iOS and macOS applications, tracked as CVE-2025-55177 , was likely chained with Apple’s ImageIO zero-day CVE-2025-43300 in zero-click attacks against fewer than 200 users.
vulnerability CVE-2025-55177
Meta’s involvement is noteworthy given a similar incident from last year, when WhatsApp said a vulnerability in its iOS and macOS apps (CVE-2025-55177) was likely used alongside the Apple ImageIO zero-day CVE-2025-43300 in zero-click attacks aimed at fewer than 200 users.
Last year, WhatsApp disclosed that a vulnerability in its iOS and macOS applications, tracked as CVE-2025-55177 , was likely chained with Apple’s ImageIO zero-day CVE-2025-43300 in zero-click attacks against fewer than 200 users.
vulnerability CVE-2025-43300
Meta’s involvement is noteworthy given a similar incident from last year, when WhatsApp said a vulnerability in its iOS and macOS apps (CVE-2025-55177) was likely used alongside the Apple ImageIO zero-day CVE-2025-43300 in zero-click attacks aimed at fewer than 200 users.
Last year, WhatsApp disclosed that a vulnerability in its iOS and macOS applications, tracked as CVE-2025-55177 , was likely chained with Apple’s ImageIO zero-day CVE-2025-43300 in zero-click attacks against fewer than 200 users.
organisation WhatsApp
Meta’s involvement is noteworthy given a similar incident from last year, when WhatsApp said a vulnerability in its iOS and macOS apps (CVE-2025-55177) was likely used alongside the Apple ImageIO zero-day CVE-2025-43300 in zero-click attacks aimed at fewer than 200 users.
Last year, WhatsApp disclosed that a vulnerability in its iOS and macOS applications, tracked as CVE-2025-55177 , was likely chained with Apple’s ImageIO zero-day CVE-2025-43300 in zero-click attacks against fewer than 200 users.
victims 200 users
Meta’s involvement is noteworthy given a similar incident from last year, when WhatsApp said a vulnerability in its iOS and macOS apps (CVE-2025-55177) was likely used alongside the Apple ImageIO zero-day CVE-2025-43300 in zero-click attacks aimed at fewer than 200 users.
Last year, WhatsApp disclosed that a vulnerability in its iOS and macOS applications, tracked as CVE-2025-55177 , was likely chained with Apple’s ImageIO zero-day CVE-2025-43300 in zero-click attacks against fewer than 200 users.
vulnerability CVE-2025-24200
Last year, Apple fixed seven more zero-days exploited in the wild, the first in January (CVE-2025-24085), the second in February (CVE-2025-24200), a third in March (CVE-2025-24201), two more in April (CVE-2025-31200 and CVE-2025-31201), and two others in December (CVE-2025-43529 and CVE-2025-14174).
organisation CVE-2025
Last year, Apple fixed seven more zero-days exploited in the wild, the first in January (CVE-2025-24085), the second in February (CVE-2025-24200), a third in March (CVE-2025-24201), two more in April (CVE-2025-31200 and CVE-2025-31201), and two others in December (CVE-2025-43529 and CVE-2025-14174).
vulnerability CVE-2025-24085
Last year, Apple fixed seven more zero-days exploited in the wild, the first in January (CVE-2025-24085), the second in February (CVE-2025-24200), a third in March (CVE-2025-24201), two more in April (CVE-2025-31200 and CVE-2025-31201), and two others in December (CVE-2025-43529 and CVE-2025-14174).
vulnerability CVE-2025-24201
Last year, Apple fixed seven more zero-days exploited in the wild, the first in January (CVE-2025-24085), the second in February (CVE-2025-24200), a third in March (CVE-2025-24201), two more in April (CVE-2025-31200 and CVE-2025-31201), and two others in December (CVE-2025-43529 and CVE-2025-14174).
organisation CVE-2025-31200
Last year, Apple fixed seven more zero-days exploited in the wild, the first in January (CVE-2025-24085), the second in February (CVE-2025-24200), a third in March (CVE-2025-24201), two more in April (CVE-2025-31200 and CVE-2025-31201), and two others in December (CVE-2025-43529 and CVE-2025-14174).
vulnerability CVE-2025-31201
Last year, Apple fixed seven more zero-days exploited in the wild, the first in January (CVE-2025-24085), the second in February (CVE-2025-24200), a third in March (CVE-2025-24201), two more in April (CVE-2025-31200 and CVE-2025-31201), and two others in December (CVE-2025-43529 and CVE-2025-14174).
vulnerability CVE-2025-43529
Last year, Apple fixed seven more zero-days exploited in the wild, the first in January (CVE-2025-24085), the second in February (CVE-2025-24200), a third in March (CVE-2025-24201), two more in April (CVE-2025-31200 and CVE-2025-31201), and two others in December (CVE-2025-43529 and CVE-2025-14174).
vulnerability CVE-2025-14174
Last year, Apple fixed seven more zero-days exploited in the wild, the first in January (CVE-2025-24085), the second in February (CVE-2025-24200), a third in March (CVE-2025-24201), two more in April (CVE-2025-31200 and CVE-2025-31201), and two others in December (CVE-2025-43529 and CVE-2025-14174).
‎September 28
The Meta Product Security team discovered and attributed the CVE-2026-86950 vulnerability to Apple on September 28.
vulnerability CVE-2026-86950
In a bulletin on September 28, the tech giant attributed the discovery of CVE-2026-86950 to the Meta Product Security team.
organisation the Meta Product Security
In a bulletin on September 28, the tech giant attributed the discovery of CVE-2026-86950 to the Meta Product Security team.
‎Sep 28, 2026
Threat actors exploited a previously unknown vulnerability in Apple's CoreGraphics library, allowing them to execute arbitrary code on affected systems.
‎September 29, 2026
Apple patched zero-day CVE-2026-86950 in CoreGraphics, which was exploited in sophisticated targeted attacks against specific iOS users.
infrastructure Ios
Apple Patches CoreGraphics Zero-Day Linked to Sophisticated Targeted Attacks Pierluigi Paganini September 29, 2026 Apple patched zero-day CVE-2026-86950 in CoreGraphics, exploited in sophisticated targeted attacks against specific iOS users.
vulnerability CVE-2026-86950
Apple Patches CoreGraphics Zero-Day Linked to Sophisticated Targeted Attacks Pierluigi Paganini September 29, 2026 Apple patched zero-day CVE-2026-86950 in CoreGraphics, exploited in sophisticated targeted attacks against specific iOS users.
organisation CoreGraphics
Apple Patches CoreGraphics Zero-Day Linked to Sophisticated Targeted Attacks Pierluigi Paganini September 29, 2026 Apple patched zero-day CVE-2026-86950 in CoreGraphics, exploited in sophisticated targeted attacks against specific iOS users.
organisation Apple
Apple Patches CoreGraphics Zero-Day Linked to Sophisticated Targeted Attacks Pierluigi Paganini September 29, 2026 Apple patched zero-day CVE-2026-86950 in CoreGraphics, exploited in sophisticated targeted attacks against specific iOS users.
‎2026/09/29
Apple has released iOS and macOS updates to patch a zero-day vulnerability, CVE-2026-86950, an out-of-bounds write issue in the CoreGraphics component that can be exploited for arbitrary code execution when it processes a specially crafted file.
infrastructure Ios
Apple on Monday released iOS and macOS updates to patch a zero-day vulnerability that may have been exploited in targeted attacks.
“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27,” Apple said in its advisory.
CVE-2026-86950 has been patched with the release of iOS 26.7.1, iPadOS 26.7.1 , macOS Tahoe 26.7.1 , and macOS Sequoia 15.8.1 .
While both iOS and macOS are impacted, Apple’s advisory suggests that attacks have only been observed against the former.
The latest iOS 27 and macOS Golden Gate 27 do not appear to be affected.
There was no further information from Apple on CVE-2026-86950 except that it has been fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
Apple has released security updates for iOS, iPadOS and macOS to fix a zero-day vulnerability, tracked as CVE-2026-86950, in CoreGraphics that may have been exploited in attacks against specific individuals.
The vulnerability affects iOS 26.7 and earlier versions before iOS 27, as well as iPadOS 26.7 and earlier and supported versions of macOS Tahoe and macOS Sequoia.
Apple released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 to address the issue.
Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.”
Apple says it knows of a report that the flaw may have been exploited in an “extremely sophisticated attack against specific targeted individuals” running versions of iOS before iOS 27.
Apple released iOS 26.7.1 and iPadOS 26.7.1 for supported iPhones and iPads, while macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 address the problem on Macs.
Apple released new versions of iOS and macOS to address a zero-day vulnerability that a threat actor is actively exploiting in targeted attacks.
The out-of-bounds write vulnerability, tracked as CVE-2026-86950 , affects Apple's CoreGraphics framework, which macOS and iOS use to render and manipulate 2D graphics.
According to Apple's advisory , the vulnerability is being exploited "in an extremely sophisticated attack against specific targeted individuals" on versions of iOS before iOS 27.
Though Apple has only referenced the attacks as targeting iOS, the company has patched the same flaw in macOS Tahoe and Sequoia, Boynton points out.
Apple released security updates to fix a zero-day vulnerability exploited in "extremely sophisticated" targeted attacks on iOS devices.
Tracked as CVE-2026-20700 , this flaw stems from an out-of-bounds write weakness discovered by Meta Product Security in CoreGraphics, a framework used for two-dimensional vector graphics, image rendering, and text drawing across iOS, macOS, iPadOS, watchOS, and tvOS.
"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27," it warned on Monday .
…generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later and Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1 Apple has addressed this issue with improved bounds checking to prevent exploitation in iOS 26.7.1 and iPadOS 26.7.1 , macOS Tahoe 26.7.1 , and macOS Sequoia 15.8.1 .
 Ravie Lakshmanan  Sep 28, 2026 Vulnerability / Endpoint Security Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks.
"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27," it added.
The shortcoming has been addressed in the following devices and operating system versions - iOS 26.7.1 and iPadOS 26.7.1 - iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS…
infrastructure Macos
Apple on Monday released iOS and macOS updates to patch a zero-day vulnerability that may have been exploited in targeted attacks.
CVE-2026-86950 has been patched with the release of iOS 26.7.1, iPadOS 26.7.1 , macOS Tahoe 26.7.1 , and macOS Sequoia 15.8.1 .
While both iOS and macOS are impacted, Apple’s advisory suggests that attacks have only been observed against the former.
The latest iOS 27 and macOS Golden Gate 27 do not appear to be affected.
There was no further information from Apple on CVE-2026-86950 except that it has been fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
Apple has released security updates for iOS, iPadOS and macOS to fix a zero-day vulnerability, tracked as CVE-2026-86950, in CoreGraphics that may have been exploited in attacks against specific individuals.
The vulnerability affects iOS 26.7 and earlier versions before iOS 27, as well as iPadOS 26.7 and earlier and supported versions of macOS Tahoe and macOS Sequoia.
Apple released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 to address the issue.
Apple released iOS 26.7.1 and iPadOS 26.7.1 for supported iPhones and iPads, while macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 address the problem on Macs.
Apple released new versions of iOS and macOS to address a zero-day vulnerability that a threat actor is actively exploiting in targeted attacks.
The out-of-bounds write vulnerability, tracked as CVE-2026-86950 , affects Apple's CoreGraphics framework, which macOS and iOS use to render and manipulate 2D graphics.
Though Apple has only referenced the attacks as targeting iOS, the company has patched the same flaw in macOS Tahoe and Sequoia, Boynton points out.
Tracked as CVE-2026-20700 , this flaw stems from an out-of-bounds write weakness discovered by Meta Product Security in CoreGraphics, a framework used for two-dimensional vector graphics, image rendering, and text drawing across iOS, macOS, iPadOS, watchOS, and tvOS.
 Ravie Lakshmanan  Sep 28, 2026 Vulnerability / Endpoint Security Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks.
Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1 are also thought to be affected.
…-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later and Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1 Apple has addressed this issue with improved bounds checking to prevent exploitation in iOS 26.7.1 and iPadOS 26.7.1 , macOS Tahoe 26.7.1 , and macOS Sequoi…
…er, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS Sequoia 15.8.1 - Macs running macOS Sequoia Earlier this February, Apple addressed a memory corruption issue in dyld ( CVE-2026-20700 , CVS…
infrastructure 26.7.1
CVE-2026-86950 has been patched with the release of iOS 26.7.1, iPadOS 26.7.1 , macOS Tahoe 26.7.1 , and macOS Sequoia 15.8.1 .
There was no further information from Apple on CVE-2026-86950 except that it has been fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
Apple released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 to address the issue.
Apple released iOS 26.7.1 and iPadOS 26.7.1 for supported iPhones and iPads, while macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 address the problem on Macs.
The shortcoming has been addressed in the following devices and operating system versions - iOS 26.7.1 and iPadOS 26.7.1 - iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS…
infrastructure 15.8.1
CVE-2026-86950 has been patched with the release of iOS 26.7.1, iPadOS 26.7.1 , macOS Tahoe 26.7.1 , and macOS Sequoia 15.8.1 .
There was no further information from Apple on CVE-2026-86950 except that it has been fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
Apple released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 to address the issue.
Apple released iOS 26.7.1 and iPadOS 26.7.1 for supported iPhones and iPads, while macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 address the problem on Macs.
…ch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS Sequoia 15.8.1 - Macs running macOS Sequoia Earlier this February, Apple addressed a memory corruption issue in dyld ( CVE-2026-20700 , CVSS score: 7.8) that it said had been weaponized in sophisticated…
infrastructure 26.7
The vulnerability affects iOS 26.7 and earlier versions before iOS 27, as well as iPadOS 26.7 and earlier and supported versions of macOS Tahoe and macOS Sequoia.
organisation macOS Tahoe
The vulnerability affects iOS 26.7 and earlier versions before iOS 27, as well as iPadOS 26.7 and earlier and supported versions of macOS Tahoe and macOS Sequoia.
Though Apple has only referenced the attacks as targeting iOS, the company has patched the same flaw in macOS Tahoe and Sequoia, Boynton points out.
organisation Macs
Apple released iOS 26.7.1 and iPadOS 26.7.1 for supported iPhones and iPads, while macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 address the problem on Macs.
Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1 are also thought to be affected.
The fact that Apple devices are strategically important endpoints at many enterprises, and many high-value targets frequently use iPhones and Macs, also makes the economics of developing exploits targeting Apple vulnerabilities more attractive.
…iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later and Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1 Apple has addressed this issue with improved bounds checking to prevent exploitation in iOS 26.7.1 and iPadOS 26.7.1 , macOS Tahoe 26.7.1 , and…
organisation iPhones
Apple released iOS 26.7.1 and iPadOS 26.7.1 for supported iPhones and iPads, while macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 address the problem on Macs.
The fact that Apple devices are strategically important endpoints at many enterprises, and many high-value targets frequently use iPhones and Macs, also makes the economics of developing exploits targeting Apple vulnerabilities more attractive.
Earlier this year, it also addressed a high-severity Beats Studio Buds flaw (CVE-2025-20701) that lets attackers in Bluetooth range spy on users' conversations, and patched older iPhones and iPads against four vulnerabilities targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit.
organisation iPads
Apple released iOS 26.7.1 and iPadOS 26.7.1 for supported iPhones and iPads, while macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 address the problem on Macs.
organisation Apple
Apple released new versions of iOS and macOS to address a zero-day vulnerability that a threat actor is actively exploiting in targeted attacks.
 Ravie Lakshmanan  Sep 28, 2026 Vulnerability / Endpoint Security Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks.
Apple patches CoreGraphics zero-day flaw exploited in attacks.
Apple Patches Meta-Reported Zero-Day Linked to ‘Extremely Sophisticated Attack’.
Apple has issued a security update designed to fix a zero-day vulnerability which it claimed may have been exploited in an “extremely sophisticated” attack.
organisation CoreGraphics
The out-of-bounds write vulnerability, tracked as CVE-2026-86950 , affects Apple's CoreGraphics framework, which macOS and iOS use to render and manipulate 2D graphics.
The flaw, tracked as CVE-2026-86950, is an out-of-bounds write issue in the CoreGraphics component that can be exploited for arbitrary code execution when it processes a specially crafted file.
The vulnerability, tracked as CVE-2026-86950 , refers to an out-of-bounds write impacting the CoreGraphics component that could lead to arbitrary code execution when processing a maliciously crafted file.
Apple patches CoreGraphics zero-day flaw exploited in attacks.
organisation Sequoia
Though Apple has only referenced the attacks as targeting iOS, the company has patched the same flaw in macOS Tahoe and Sequoia, Boynton points out.
organisation Meta Product Security
Tracked as CVE-2026-20700 , this flaw stems from an out-of-bounds write weakness discovered by Meta Product Security in CoreGraphics, a framework used for two-dimensional vector graphics, image rendering, and text drawing across iOS, macOS, iPadOS, watchOS, and tvOS.
Meta Product Security discovered and reported the vulnerability to Apple.
It credited Meta Product Security with discovering and reporting the issue.
organisation Vulnerability / Endpoint Security
 Ravie Lakshmanan  Sep 28, 2026 Vulnerability / Endpoint Security Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks.
infrastructure 11 iPhone
The shortcoming has been addressed in the following devices and operating system versions - iOS 26.7.1 and iPadOS 26.7.1 - iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS…
The vulnerability affects a broad range of Apple devices, including iPhones dating back to the iPhone 11 and multiple generations of iPads.
" The complete list of devices impacted by this zero-day is extensive, as it impacts both older and newer models, including: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later and Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1…
organisation iPad
The shortcoming has been addressed in the following devices and operating system versions - iOS 26.7.1 and iPadOS 26.7.1 - iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS…
" The complete list of devices impacted by this zero-day is extensive, as it impacts both older and newer models, including: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later and Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.…
infrastructure 12.9-inch
The shortcoming has been addressed in the following devices and operating system versions - iOS 26.7.1 and iPadOS 26.7.1 - iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS…
organisation Meta
No information has been shared on the attacks exploiting CVE-2026-86950, but Apple noted that it learned about the vulnerability from Meta’s product security team.
The involvement of Meta is particularly interesting because the company has previously identified attacks involving Apple vulnerabilities and targeted users of its messaging platforms.
Apple credited Meta with disclosing the vulnerability to the company but has not released any information on the exploit activity or who it might be targeting.
organisation KEV
CISA has yet to add CVE-2026-86950 to its KEV catalog .
organisation Jamf
Adam Bynton, enterprise security manager at Jamf, says CVE-2026-86950 is significant because it affects a component of the graphics stack used to process content across Apple's operating systems.
organisation SOCRadar
Ensar Seker, chief information security officer at SOCRadar, says a memory-corruption vulnerability like CVE-2026-86950, which can lead to arbitrary code execution during file processing, creates the potential for a low-interaction or potentially zero-click attack chain when combined with an appropriate delivery mechanism.
organisation WhatsApp
As an example, he pointed to CVE-2025-55177 , a vulnerability in WhatsApp that attackers exploited in combination with CVE-2025-43300 , another out-of-bounds zero-day vulnerability, this time in Apple's ImageIQ technology.
organisation CVE-2025
As an example, he pointed to CVE-2025-55177 , a vulnerability in WhatsApp that attackers exploited in combination with CVE-2025-43300 , another out-of-bounds zero-day vulnerability, this time in Apple's ImageIQ technology.
organisation PDF
Apple has not said how the malicious file is delivered, but because CoreGraphics handles 2D graphics and PDF rendering across the operating system, it could arrive via web pages, email attachments, or messaging apps, where automatic attachment and link previews could enable zero-click exploitation.
organisation SecurityWeek
In response to SecurityWeek’s inquiry, Meta said that, as part of its routine security work, it regularly reports vulnerabilities found in third-party software to other vendors so they can be patched.
There is no evidence that the new CoreGraphics vulnerability was used through WhatsApp, and SecurityWeek reported that it was seeking clarification from Meta.
organisation Apple Patches CoreGraphics Zero Day
Apple Patches CoreGraphics Zero Day Exploited in Attacks.
organisation IR
Many IR playbooks still stop at the laptop.”
organisation iPhone
It appears that this one was found and reported to the iPhone giant before malicious researchers had a chance to discover and monetize/weaponize it.
The iPhone maker said the issue was addressed with improved bounds checking.
organisation CVSS
…on and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS Sequoia 15.8.1 - Macs running macOS Sequoia Earlier this February, Apple addressed a memory corruption issue in dyld ( CVE-2026-20700 , CVSS score: 7.8) that it said had been weaponized in sophisticated cyber attacks.
Extremely Sophisticated Attacks The flaw has a CVSS score of 8.8 and can allow an attacker to execute arbitrary code on an affected system.
infrastructure 7.8
…on and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS Sequoia 15.8.1 - Macs running macOS Sequoia Earlier this February, Apple addressed a memory corruption issue in dyld ( CVE-2026-20700 , CVSS score: 7.8) that it said had been weaponized in sophisticated cyber attacks.
organisation Apple Patches CoreGraphics Zero-Day
Apple Patches CoreGraphics Zero-Day Linked to Sophisticated Targeted Attacks.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, Apple)
organisation NSO Group
WhatsApp, for instance, has previously accused Israel's NSO Group of using its servers to distribute its Pegasus spyware on mobile devices belonging to targeted individuals.
organisation Vulnerability Weaponized
Apple Zero-Day Vulnerability Weaponized in Targeted Attacks.
organisation Seker
The trend is not simply that Apple has more vulnerabilities, Seker continues.
organisation iPad Air
…ed by this zero-day is extensive, as it impacts both older and newer models, including: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later and Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1 Apple has addressed this issue with…
…the following devices and operating system versions - iOS 26.7.1 and iPadOS 26.7.1 - iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS Sequoia 15.8.1 - Macs running macOS…
organisation NFL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
organisation CHANEL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
‎Oct. 2
Threat actors are using the CVE-2026-86950 vulnerability to potentially compromise affected agencies by October 2.
vulnerability CVE-2026-86950
As per BOD 26-04, these agencies must also conduct a forensic triage by Oct. 2 to determine if they have already been compromised via CVE-2026-86950.
Tactical Metrics
Metrics
infrastructure
‎Ios
Affected Product
Apple on Monday released iOS and macOS updates to patch a zero-day vulnerability that may have been exploited in targeted attacks.
“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27,” Apple said in its advisory.
Meta’s involvement is noteworthy given a similar incident from last year, when WhatsApp said a vulnerability in its iOS and macOS apps (CVE-2025-55177) was likely used alongside the Apple ImageIO zero-day CVE-2025-43300 in zero-click attacks aimed at fewer than 200 users.
CVE-2026-86950 has been patched with the release of iOS 26.7.1, iPadOS 26.7.1 , macOS Tahoe 26.7.1 , and macOS Sequoia 15.8.1 .
While both iOS and macOS are impacted, Apple’s advisory suggests that attacks have only been observed against the former.
The latest iOS 27 and macOS Golden Gate 27 do not appear to be affected.
There was no further information from Apple on CVE-2026-86950 except that it has been fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
Apple Patches CoreGraphics Zero-Day Linked to Sophisticated Targeted Attacks Pierluigi Paganini September 29, 2026 Apple patched zero-day CVE-2026-86950 in CoreGraphics, exploited in sophisticated targeted attacks against specific iOS users.
Apple has released security updates for iOS, iPadOS and macOS to fix a zero-day vulnerability, tracked as CVE-2026-86950, in CoreGraphics that may have been exploited in attacks against specific individuals.
The vulnerability affects iOS 26.7 and earlier versions before iOS 27, as well as iPadOS 26.7 and earlier and supported versions of macOS Tahoe and macOS Sequoia.
Apple released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 to address the issue.
Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.”
Apple says it knows of a report that the flaw may have been exploited in an “extremely sophisticated attack against specific targeted individuals” running versions of iOS before iOS 27.
Last year, WhatsApp disclosed that a vulnerability in its iOS and macOS applications, tracked as CVE-2025-55177 , was likely chained with Apple’s ImageIO zero-day CVE-2025-43300 in zero-click attacks against fewer than 200 users.
Apple released iOS 26.7.1 and iPadOS 26.7.1 for supported iPhones and iPads, while macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 address the problem on Macs.
Apple released new versions of iOS and macOS to address a zero-day vulnerability that a threat actor is actively exploiting in targeted attacks.
The out-of-bounds write vulnerability, tracked as CVE-2026-86950 , affects Apple's CoreGraphics framework, which macOS and iOS use to render and manipulate 2D graphics.
According to Apple's advisory , the vulnerability is being exploited "in an extremely sophisticated attack against specific targeted individuals" on versions of iOS before iOS 27.
Though Apple has only referenced the attacks as targeting iOS, the company has patched the same flaw in macOS Tahoe and Sequoia, Boynton points out.
Apple released security updates to fix a zero-day vulnerability exploited in "extremely sophisticated" targeted attacks on iOS devices.
Tracked as CVE-2026-20700 , this flaw stems from an out-of-bounds write weakness discovered by Meta Product Security in CoreGraphics, a framework used for two-dimensional vector graphics, image rendering, and text drawing across iOS, macOS, iPadOS, watchOS, and tvOS.
"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27," it warned on Monday .
…generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later and Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1 Apple has addressed this issue with improved bounds checking to prevent exploitation in iOS 26.7.1 and iPadOS 26.7.1 , macOS Tahoe 26.7.1 , and macOS Sequoia 15.8.1 .
 Ravie Lakshmanan  Sep 28, 2026 Vulnerability / Endpoint Security Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks.
"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27," it added.
The shortcoming has been addressed in the following devices and operating system versions - iOS 26.7.1 and iPadOS 26.7.1 - iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS…
Metrics
infrastructure
‎Macos
Affected Product
Apple on Monday released iOS and macOS updates to patch a zero-day vulnerability that may have been exploited in targeted attacks.
Meta’s involvement is noteworthy given a similar incident from last year, when WhatsApp said a vulnerability in its iOS and macOS apps (CVE-2025-55177) was likely used alongside the Apple ImageIO zero-day CVE-2025-43300 in zero-click attacks aimed at fewer than 200 users.
CVE-2026-86950 has been patched with the release of iOS 26.7.1, iPadOS 26.7.1 , macOS Tahoe 26.7.1 , and macOS Sequoia 15.8.1 .
While both iOS and macOS are impacted, Apple’s advisory suggests that attacks have only been observed against the former.
The latest iOS 27 and macOS Golden Gate 27 do not appear to be affected.
Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1 are also thought to be affected.
There was no further information from Apple on CVE-2026-86950 except that it has been fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
Apple has released security updates for iOS, iPadOS and macOS to fix a zero-day vulnerability, tracked as CVE-2026-86950, in CoreGraphics that may have been exploited in attacks against specific individuals.
The vulnerability affects iOS 26.7 and earlier versions before iOS 27, as well as iPadOS 26.7 and earlier and supported versions of macOS Tahoe and macOS Sequoia.
Apple released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 to address the issue.
Last year, WhatsApp disclosed that a vulnerability in its iOS and macOS applications, tracked as CVE-2025-55177 , was likely chained with Apple’s ImageIO zero-day CVE-2025-43300 in zero-click attacks against fewer than 200 users.
Apple released iOS 26.7.1 and iPadOS 26.7.1 for supported iPhones and iPads, while macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 address the problem on Macs.
Apple released new versions of iOS and macOS to address a zero-day vulnerability that a threat actor is actively exploiting in targeted attacks.
The out-of-bounds write vulnerability, tracked as CVE-2026-86950 , affects Apple's CoreGraphics framework, which macOS and iOS use to render and manipulate 2D graphics.
Though Apple has only referenced the attacks as targeting iOS, the company has patched the same flaw in macOS Tahoe and Sequoia, Boynton points out.
Tracked as CVE-2026-20700 , this flaw stems from an out-of-bounds write weakness discovered by Meta Product Security in CoreGraphics, a framework used for two-dimensional vector graphics, image rendering, and text drawing across iOS, macOS, iPadOS, watchOS, and tvOS.
…-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later and Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1 Apple has addressed this issue with improved bounds checking to prevent exploitation in iOS 26.7.1 and iPadOS 26.7.1 , macOS Tahoe 26.7.1 , and macOS Sequoi…
 Ravie Lakshmanan  Sep 28, 2026 Vulnerability / Endpoint Security Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks.
…er, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS Sequoia 15.8.1 - Macs running macOS Sequoia Earlier this February, Apple addressed a memory corruption issue in dyld ( CVE-2026-20700 , CVS…
Metrics
victims
200
Users
Meta’s involvement is noteworthy given a similar incident from last year, when WhatsApp said a vulnerability in its iOS and macOS apps (CVE-2025-55177) was likely used alongside the Apple ImageIO zero-day CVE-2025-43300 in zero-click attacks aimed at fewer than 200 users.
Last year, WhatsApp disclosed that a vulnerability in its iOS and macOS applications, tracked as CVE-2025-55177 , was likely chained with Apple’s ImageIO zero-day CVE-2025-43300 in zero-click attacks against fewer than 200 users.
Metrics
infrastructure
‎26.7.1
Software Version
CVE-2026-86950 has been patched with the release of iOS 26.7.1, iPadOS 26.7.1 , macOS Tahoe 26.7.1 , and macOS Sequoia 15.8.1 .
There was no further information from Apple on CVE-2026-86950 except that it has been fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
Apple released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 to address the issue.
Apple released iOS 26.7.1 and iPadOS 26.7.1 for supported iPhones and iPads, while macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 address the problem on Macs.
The shortcoming has been addressed in the following devices and operating system versions - iOS 26.7.1 and iPadOS 26.7.1 - iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS…
Metrics
infrastructure
‎15.8.1
Software Version
CVE-2026-86950 has been patched with the release of iOS 26.7.1, iPadOS 26.7.1 , macOS Tahoe 26.7.1 , and macOS Sequoia 15.8.1 .
There was no further information from Apple on CVE-2026-86950 except that it has been fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
Apple released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 to address the issue.
Apple released iOS 26.7.1 and iPadOS 26.7.1 for supported iPhones and iPads, while macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 address the problem on Macs.
…ch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS Sequoia 15.8.1 - Macs running macOS Sequoia Earlier this February, Apple addressed a memory corruption issue in dyld ( CVE-2026-20700 , CVSS score: 7.8) that it said had been weaponized in sophisticated…
Metrics
infrastructure
‎26.7
Software Version
The vulnerability affects iOS 26.7 and earlier versions before iOS 27, as well as iPadOS 26.7 and earlier and supported versions of macOS Tahoe and macOS Sequoia.
Metrics
infrastructure
11
Iphone
The vulnerability affects a broad range of Apple devices, including iPhones dating back to the iPhone 11 and multiple generations of iPads.
" The complete list of devices impacted by this zero-day is extensive, as it impacts both older and newer models, including: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later and Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1…
The shortcoming has been addressed in the following devices and operating system versions - iOS 26.7.1 and iPadOS 26.7.1 - iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS…
Metrics
infrastructure
‎12.9-inch
Software Version
The shortcoming has been addressed in the following devices and operating system versions - iOS 26.7.1 and iPadOS 26.7.1 - iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS…
Metrics
infrastructure
‎7.8
Software Version
…on and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later macOS Tahoe 26.7.1 - Macs running macOS Tahoe macOS Sequoia 15.8.1 - Macs running macOS Sequoia Earlier this February, Apple addressed a memory corruption issue in dyld ( CVE-2026-20700 , CVSS score: 7.8) that it said had been weaponized in sophisticated cyber attacks.
Intelligence Sources
The Hacker News 2026-09-28
Infosecurity-Magazine 2026-09-30
Dark Reading 2026-09-29
Security Affairs 2026-09-29
BleepingComputer 2026-09-29
SecurityWeek 2026-09-29