we_are_coded.by CODE · The world, decoded
БГ
Apple

Apple patches a CoreGraphics hole that may have been used against specific people

Apple · event date: 28 September 2026Security

iOS 26.7.1 and iPadOS 26.7.1 shipped on 28 September with a single fix. A malicious file can lead to code execution, and Apple is aware of a report that the hole may have been exploited in an extremely sophisticated attack against specific individuals.

In short
  • CVE-2026-86950 is an out-of-bounds write in CoreGraphics, the system's graphics library.
  • Apple is aware of a report of exploitation against specific individuals on versions of iOS before iOS 27.
  • It was found by Meta Product Security. The update covers iPhone 11 and later and the matching iPads.
Checked on1 October 2026Responsible editorTsvetelin IvanovHow we workMethod · Corrections

An update with one fix is the clearest signal Apple knows how to send. When they ship a version for a single line, the line matters.

The facts: on 28 September 2026 Apple released iOS 26.7.1 and iPadOS 26.7.1 with a fix for CVE-2026-86950 in CoreGraphics. Processing a maliciously crafted file may lead to arbitrary code execution; the issue is an out-of-bounds write, addressed with improved bounds checking. Apple writes that it is aware of a report that the vulnerability may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. It was found by Meta Product Security. The update is for iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later and iPad mini 5th generation and later.

Apple's wording is worth reading slowly. "May have been exploited". "Specific targeted individuals". This is not a mass campaign against every phone. If the report is right, it is a tool that someone has been pointing at particular people.

If you are not one of the specific people the attack was aimed at, you probably were not a target. But once it is described, a hole stops belonging only to those who used it first.

The update with a single fix is the one you do not put off.

The bulletin is for iOS 26, and the attack Apple knows about is on versions before iOS 27. If your phone is still on 26: Settings, General, Software Update. Tonight, while it charges.

The visual is generated code art. No third-party images.
Follow usFacebookLinkedIn
Official primary sources
→Apple - About the security content of iOS 26.7.1 and iPadOS 26.7.1, 28.09.2026
Original: https://wearecoded.com/en/articles/apple-coregraphics-cve-2026-86950.html
ShareFacebookXLinkedInTelegramWhatsApp

More on this

Security
Security
CISA19 August 2026Vulnerabilities

Five holes entered the actively exploited catalogue in two days

On 17 and 18 August the US agency CISA added five vulnerabilities to its catalogue of known exploited flaws. Inside are macOS, VMware vCenter, SharePoint, a Microsoft service for encrypted connections, and Ray, which sits under part of the world's AI training.

Read →
Security
CISA (KEV10 July 2026Vulnerabilities

Four Joomla extensions land on the actively exploited list in four days

CISA added Balbooa Forms and iCagenda to its catalog of vulnerabilities being exploited right now. Both allow unauthenticated file upload and code execution on the server. Three days earlier, two other Joomla extensions joined the same list - with the same hole.

Read →
Security
runZero3 July 2026

Seven holes in FatFs threaten millions of embedded devices, and there's no full patch

runZero disclosed 7 vulnerabilities at once in the FatFs file system - embedded in drones, cameras, hardware wallets, and dozens of platforms. Only one has been patched. For the rest, there's no fix yet.

Read →
← Back to all news