{"id":"apple-coregraphics-targeted-attacks-sep-2026","category":"patch","status":"live","title":"Apple fixes CoreGraphics zero-day CVE-2026-86950 linked to targeted attacks","tldr":"A CoreGraphics flaw could let a malicious file run code on affected iPhones, iPads and Macs. Targeted exploitation was reported. Fixes now include older devices: install the latest Apple software update offered for your device.","summary":"CVE-2026-86950 is a memory-writing flaw in CoreGraphics, Apple's graphics component, that can let a malicious file run an attacker's code when processed. Apple disclosed it on 28 September, credited Meta Product Security and said it may have been used in sophisticated attacks against specific individuals on iOS versions before iOS 27. Initial fixes covered iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. CISA listed it as exploited on 29 September. By 27 October, Apple had extended protection to older iPhones and iPads through the 18.7.11 branch. Fixes are now available for all affected supported branches in Apple's CVE product data. Canada's alert also lists several version-27 operating systems, watchOS and visionOS; Apple's CVE product data does not list those as affected. The reviewed sources do not disclose victim numbers, attacker identities or whether victims were notified.","action":"On iPhone or iPad, open Settings → General → Software Update and install the latest offered update; the fixes start at 18.7.11 or 26.7.1 for the affected branches. On a Mac, use System Settings → General → Software Update; the fixes start at Sequoia 15.8.1 or Tahoe 26.7.1.","product":"Apple iPhone, iPad and Mac","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-86950"],"tags":["apple","ios","ipados","macos","coregraphics","zero-day"],"affected":["iOS and iPadOS 18 before 18.7.11","iOS and iPadOS 26 before 26.7.1","macOS Sequoia before 15.8.1","macOS Tahoe before 26.7.1"],"fixed":["iOS and iPadOS 18.7.11","iOS and iPadOS 26.7.1","macOS Sequoia 15.8.1","macOS Tahoe 26.7.1"],"matches":[{"platform":"ios","app":"iOS 18","bundle":"","fixed":"18.7.11"},{"platform":"ios","app":"iOS 26","bundle":"","fixed":"26.7.1"},{"platform":"ipados","app":"iPadOS 18","bundle":"","fixed":"18.7.11"},{"platform":"ipados","app":"iPadOS 26","bundle":"","fixed":"26.7.1"},{"platform":"macos","app":"macOS Sequoia","bundle":"","fixed":"15.8.1"},{"platform":"macos","app":"macOS Tahoe","bundle":"","fixed":"26.7.1"}],"sources":[{"kind":"advisory","title":"About the security content of iOS 26.7.1 and iPadOS 26.7.1","url":"https://support.apple.com/en-us/149226","by":"Apple","date":"2026-09-28"},{"kind":"advisory","title":"About the security content of macOS Sequoia 15.8.1","url":"https://support.apple.com/en-us/149229","by":"Apple","date":"2026-09-28"},{"kind":"advisory","title":"CVE-2026-86950 Detail — includes Apple's affected-product data","url":"https://nvd.nist.gov/vuln/detail/cve-2026-86950?trk=public_post_comment-text","by":"NIST","date":"2026-10-27"},{"kind":"advisory","title":"Apple security advisory (AV26-971)","url":"https://www.cyber.gc.ca/en/alerts-advisories/apple-security-advisory-av26-971","by":"Canadian Centre for Cyber Security","date":"2026-09-29"},{"kind":"advisory","title":"Apple Releases Security Updates for macOS, iOS, and iPadOS","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4860","by":"NHS England","date":"2026-09-30"},{"kind":"news","title":"Apple backports CoreGraphics zero-day patches to older iPhones","url":"https://www.bleepingcomputer.com/news/apple/apple-backports-coregraphics-zero-day-patches-to-older-iphones/","by":"BleepingComputer","date":"2026-10-27"}],"started":"2026-09-28","closed":null,"created":"2026-11-03T20:19:51.150Z","updated":"2026-11-03T20:19:51.150Z","cve_notes":[{"cve":"CVE-2026-86950","name":"Out-of-bounds write in Apple CoreGraphics","what":"CoreGraphics can write outside its allocated memory while processing a malicious file, potentially allowing an attacker to run code on an affected iPhone, iPad or Mac.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-10-27","added":"2026-11-03T20:12:05.486Z","kind":"new-fix","text":"BleepingComputer reported that Apple had extended the fix to older iPhones and iPads, including the iPhone XS, XS Max and XR. Apple's affected-product data lists 18.7.11 as the fixed version for the older iOS and iPadOS branch.","url":"https://www.bleepingcomputer.com/news/apple/apple-backports-coregraphics-zero-day-patches-to-older-iphones/","by":"BleepingComputer","patch":"patched"},{"at":"2026-09-30","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"NHS England warned that the flaw was being exploited and urged updates to iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4860","by":"NHS England","patch":null},{"at":"2026-09-29","added":"2026-11-03T20:12:05.486Z","kind":"cisa-added","text":"The Canadian Centre for Cyber Security reported that CISA added CVE-2026-86950 to its Known Exploited Vulnerabilities catalogue that day.","url":"https://www.cyber.gc.ca/en/alerts-advisories/apple-security-advisory-av26-971","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-09-28","added":"2026-11-03T20:12:05.486Z","kind":"new-fix","text":"Apple also released macOS Sequoia 15.8.1, fixing the same CoreGraphics flaw on that Mac operating system.","url":"https://support.apple.com/en-us/149229","by":"Apple","patch":null},{"at":"2026-09-28","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"Apple released iOS and iPadOS 26.7.1 for CVE-2026-86950. It said processing a malicious file could run code and that the flaw may have been used against specific individuals running iOS versions before iOS 27.","url":"https://support.apple.com/en-us/149226","by":"Apple","patch":"partial"}],"url":"https://hard.fyi/live/apple-coregraphics-targeted-attacks-sep-2026/","json":"https://hard.fyi/api/live?id=apple-coregraphics-targeted-attacks-sep-2026"}