Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks.
The vulnerability, tracked as CVE-2026-86950, refers to an out-of-bounds write impacting the CoreGraphics component that could lead to arbitrary code execution when processing a maliciously crafted file.
The iPhone maker said the issue was addressed with improved bounds checking. It credited Meta Product Security with discovering and reporting the issue.
“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27,” it added.
However, the company offered no details on how many individuals were targeted, if any of those attempts were successful, or when the first instance of CVE-2026-86950 exploitation occurred.
The shortcoming has been addressed in the following devices and operating system versions –
- iOS 26.7.1 and iPadOS 26.7.1 – iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
- macOS Tahoe 26.7.1 – Macs running macOS Tahoe
- macOS Sequoia 15.8.1 – Macs running macOS Sequoia
Earlier this February, Apple addressed a memory corruption issue in dyld (CVE-2026-20700, CVSS score: 7.8) that it said had been weaponized in sophisticated cyber attacks.