Apple has released iOS 26.7.1 and iPadOS 26.7.1 to address a critical zero-day vulnerability, CVE-2026-86950, in the CoreGraphics framework. CoreGraphics is a fundamental Apple component responsible for processing and rendering graphics, images, and documents. The vulnerability is an out-of-bounds write that could allow an attacker to execute arbitrary code by convincing a targeted user to process a specially crafted malicious file. Apple confirmed that the vulnerability may have been exploited in highly sophisticated, targeted attacks against specific individuals running iOS versions before iOS 27.

Successful exploitation could occur when a vulnerable device opens, previews, downloads, or otherwise processes a maliciously crafted file, potentially triggering the vulnerable CoreGraphics code path. An attacker who successfully exploits the flaw could achieve arbitrary code execution within the affected process, potentially enabling unauthorized commands, access to sensitive information, installation of malicious components, or further compromise depending on the privileges and additional vulnerabilities available. Apple has not disclosed technical details about the attackers, targeted victims, malicious files, or whether CVE-2026-86950 was chained with other vulnerabilities. The targeted nature of the reported exploitation indicates that the issue presents particular concern for high-value users and organizations, although Apple has not publicly identified specific victims or attack groups.

Apple released the security updates on September 28, 2026, and addressed the vulnerability through improved bounds checking, preventing CoreGraphics from writing data outside valid memory boundaries. The vulnerability affects iPhone 11 and later and supported iPad devices, including iPad Pro 12.9-inch (3rd generation and later), iPad Pro 11-inch (1st generation and later), iPad Air (3rd generation and later), iPad (8th generation and later), and iPad mini (5th generation and later). CVE-2026-86950 was reported by Meta Product Security, and Apple acknowledged that exploitation may have occurred before the fixes became available.

Organizations and users should prioritize deployment of iOS 26.7.1 and iPadOS 26.7.1 on affected devices and avoid processing files from untrusted or suspicious sources until systems are patched. Security teams managing Apple fleets should verify update deployment through their mobile device management (MDM) platforms and identify devices still running vulnerable versions. Users can install the update through Settings - General - Software Update. Given the confirmed possibility of exploitation in targeted attacks, timely patching is particularly important for devices used to access sensitive corporate, financial, administrative, or confidential information.