Apple fixes CoreGraphics flaw CVE-2026-86950 used in targeted attacks
iOS 26.7.1 and macOS updates fix an out-of-bounds write that Apple says may have been exploited against specific individuals. Update managed devices promptly.
What happened
On 28 September 2026 Apple released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 to fix CVE-2026-86950, an out-of-bounds write in CoreGraphics. A maliciously crafted file could run arbitrary code on the device. Apple says it is aware of a report that the issue may have been exploited in an "extremely sophisticated attack against specific targeted individuals". Meta Product Security is credited with the discovery.
Who is affected
iPhone 11 and newer, and current iPad Pro, iPad Air, iPad and iPad mini models, on versions before the fixed releases.
What to do now
- Push the updates through your mobile device management and set a short deadline.
- Prioritise devices used by executives, administrators and anyone handling sensitive negotiations, who are the typical targets of this kind of attack.
Why it matters for SOC teams
Targeted mobile exploits rarely show up in network logs. Device update status from your MDM is a useful signal to bring into the SIEM, so that unpatched high-risk devices are visible next to other alerts.
Sources
Prepared with AI assistance by the Claire Security research team, based on the sources listed.
Catch threats like these around the clock
Claire Security triages every alert with auditable AI, on your own servers.
Request a demo