Apple Fixes CoreGraphics Flaw Used to Target iPhone Users (CVE-2026-86950)

A booby-trapped file can lead to arbitrary code execution on an iPhone. That is the risk tied to the CoreGraphics security flaw CVE-2026-86950, which Apple has just patched with a new iOS release, among others. Here’s what you need to know.

On September 28, 2026, Apple released iOS 26.7.1 and iPadOS 26.7.1, as well as macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Apple released these new updates to fix just one security issue: CVE-2026-86950, located in CoreGraphics. This framework, also known as Quartz 2D, is used by Apple systems to render and process graphical elements.

The vulnerability in question is an out-of-bounds write. In practice, processing a malicious file could therefore lead to arbitrary code execution on the targeted device. Apple has now fixed the issue, although it did not specify what kind of file could trigger the flaw.

Most importantly, Apple acknowledges that this flaw may have been exploited. And that is likely what pushed Apple to move quickly by rolling out these new security updates. "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specifically targeted individuals on versions of iOS prior to iOS 27", the security bulletin states.

A targeted attack, with very few details

For the rest, Apple is sticking to its usual approach: no comment, no details. We do not know who was targeted, when it happened, or even whether the attacks were successful. Apple mentions possible, not confirmed, exploitation, but given the context, this was likely a flaw used in espionage-related operations.

This warning about potential exploitation applies only to iOS, and therefore to iPhones. Even so, the fix was also delivered to macOS Tahoe and macOS Sequoia, which makes sense because CoreGraphics is a shared component across Apple’s operating systems.

Which updates should you install?

Here are the versions that protect you from CVE-2026-86950:

• iPhone : iOS 26.7.1, for iPhone 11 and later models.
• iPad : iPadOS 26.7.1, for iPad Pro 12.9-inch (3rd generation and later), iPad Pro 11-inch (1st generation and later), iPad Air (3rd generation and later), iPad (8th generation and later), and iPad mini (5th generation and later).
• Mac running macOS Tahoe : macOS Tahoe 26.7.1.
• Mac running macOS Sequoia : macOS Sequoia 15.8.1.

Over to you!

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio