Apple patches zero-day exploit possibly used in “extremely sophisticated” attacks
The bug in CoreGraphics is probably being exploited in spyware like Pegasus.
Image by rafapress | Shutterstock
Follow us
- Apple fixed a zero-day flaw in older iOS, iPadOS, and macOS versions.
- The flaw could let attackers run code when a device processes a malicious file.
- Apple says the flaw may have been used in sophisticated attacks against specific people.
- Meta reported the issue to Apple, but Apple has not said how attackers delivered the malicious file.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Apple has released security fixes addressing a zero-day vulnerability in older versions of iOS, iPadOS, and macOS, noting that the flaw might have been exploited in complex targeted cyberattacks.
The flaw, tracked as CVE-2026-86950, is an out-of-bounds write issue in the CoreGraphics component that can be exploited for arbitrary code execution when it processes a specially crafted file.
According to Apple, this particular vulnerability has been patched with the release of iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. The issue was addressed with improved bounds checking.
The zero-day flaw has not yet been added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities Catalog, but it appears to be quite dangerous, judging by Apple’s security update.
Apple got the info from Meta
“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27,” the iPhone maker said.
Has your password leaked?
“Processing a maliciously crafted file may lead to arbitrary code execution,” Apple added, although it offered no details on how many persons were targeted and whether those attacks were successful.
Some tidbits of information offer additional clues about the exploit, though. For instance, Apple notes that it learned about the vulnerability from Meta’s product security team.
This is important because last year, WhatsApp, one of Meta’s apps, said it uncovered a similar vulnerability in its iOS and macOS messaging apps, which crooks exploited to execute a spyware campaign.
The vulnerability, called CVE-2025-55177, could have allowed threat actors to trigger the processing of harmful content from external URLs hidden in seemingly ordinary messages on a target's device.
It’s not yet clear whether the newly fixed vulnerability was exploited specifically through WhatsApp, however. And indeed, Apple doesn’t say how the malicious file is delivered.
The new patch follows reports from Serbia
But CoreGraphic handles 2D graphics and PDF rendering across the operating system, so the file could arrive via email attachments, web pages, and, of course, messaging apps.
On these apps, automatic attachment and link previews could enable zero-click exploitation, by now common in spyware attacks.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Finally, in its update, Apple mentions a recent report about targeted cyberattacks. It just so happens that in early September, the SHARE Foundation – a non-profit civil society organization based in Serbia – announced that at least 14 people in the country had been targeted with Pegasus spyware since the beginning of 2026.
The attackers used a zero-click exploit to infect the devices with surveillance software. This means the device was infected remotely, without the user's knowledge or interaction.
Judging from Apple’s latest advisory, the latest iOS 27 and macOS Golden Fate 28 don’t appear to have been affected. On the other hand, release notes for both macOS 27.0.1 and visionOS 27.0.1 admit to “bug fixes” and “security fixes,” respectively.
