Apple patches CoreGraphics zero-day already exploited in targeted attacks

Apple patched an out-of-bounds write zero-day in CoreGraphics (CVE-2026-86950) that could allow arbitrary code execution when processing a crafted file. Meta Product Security reported the flaw and Apple said it may have been exploited in an "extremely sophisticated" targeted campaign against a small number of individuals; details on victims, attackers, and exploitation specifics were not disclosed. The fix is included in iOS 26.7.1 and iPadOS 26.7.1 for supported devices; users on affected releases are advised to update.