Apple Patches CoreGraphics Flaw Affecting Legacy iOS, iPadOS and macOS Versions

Apple has issued a security update that resolves a vulnerability tracked as CVE-2026-86950 in iOS 26, iPadOS 26 and macOS 26. The flaw resides in the CoreGraphics component of the operating system’s graphics engine and could enable arbitrary code execution through a maliciously crafted file. Apple’s patch adds stricter bounds checking to prevent the out-of-bounds write that underlies the issue.

Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks TechCrunch

The bug was discovered by Meta’s product security team, which reported it to Apple. The company has not disclosed details about any successful exploits, the number of affected users, or the timeline of any attacks.

TechCrunch

Apple’s own statistics indicate that nearly four-in-five iPhone owners remain on iOS 26, meaning a large installed base is potentially exposed. The graphics engine’s broad access to system resources means an exploit could allow a hacker to steal a wide range of personal data. Belgian cybersecurity firm ironPeak described the vulnerability as a “zero-click” flaw that could be triggered via a malicious iMessage without user interaction, bypassing Apple’s BlastDoor sandbox protection.

TechCrunchApple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks

Apple confirmed that devices running the latest iOS 27, iPadOS 27 and macOS 27—released earlier this month—are not vulnerable to CVE-2026-86950 and also received the new update. The company declined to comment on the discovery process or any known incidents of exploitation. Meta’s product security team was credited for the discovery, but offered no additional remarks. ironPeak published a technical write-up of the flaw but did not indicate any active exploitation beyond the possibility noted by Apple.

Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks

Apple recommends that all users of iOS 26, iPadOS 26 and macOS 26 install the update promptly. The company also recently patched a separate critical bug, CVE-2026-86869, which could have allowed silent data theft. Continued monitoring by security researchers is expected to assess whether any exploitation attempts occurred before the patch was applied.

TechCrunch