Apple released iOS and macOS updates on Monday to patch a zero-day vulnerability that may have been exploited for targeted attacks.
The bug, tracked as CVE-2026-86950, is an out-of-bounds write issue in the CoreGraphics component that can be exploited to execute arbitrary code when processing a specially crafted file.
Apple hasn’t said how the malicious file is delivered, but since CoreGraphics handles 2D graphics and PDF rendering throughout the operating system, it could arrive via web pages, email attachments or messaging apps, where automatic attachment and link previews could allow for no-click exploitation.
“Apple is aware of a report that this issue may have been exploited in a highly sophisticated attack against specific targets on versions of iOS prior to iOS 27,” Apple said in its advisory.
No information was shared about the attacks exploiting CVE-2026-86950, but Apple said it learned about the vulnerability from Meta’s product security team.
Meta’s involvement is notable given a similar incident last year, when WhatsApp said a vulnerability in its iOS and macOS apps (CVE-2025-55177) was likely used alongside the Apple ImageIO zero-day vulnerability CVE-2025-43300 in zero-click attacks that targeted fewer than 200 users.
It is unclear whether the newly patched CoreGraphics flaw was exploited via WhatsApp. Safety Week has reached out to Meta for clarification and will update this article if the company responds.
CVE-2026-86950 was patched with the release of iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1And macOS Sequoia 15.8.1.
Although both iOS and macOS are affected, Apple’s advisory suggests that attacks have only been observed against the former. The latest iOS 27 and macOS Golden Gate 27 do not appear to be affected.
CISA has yet to add CVE-2026-86950 KEV catalog. This would be the ninth Apple product defect to be added to the catalog this year.
Related: Apple fixes 87 security vulnerabilities in iOS, 155 in macOS Tahoe
Related: Apple fixes dozens of security vulnerabilities in iOS, macOS and Safari
Related: Citrix confirms 2 NetScaler zero-days after administrators pull the plug
