CVE-2026-86950: Apple CoreGraphics Zero-Day Linked to Extremely Sophisticated Targeted Attacks

Apple disclosed CVE-2026-86950, an out-of-bounds write in CoreGraphics that can lead to arbitrary code execution when a maliciously crafted file is processed; Meta Product Security reported the issue and Apple released emergency fixes on September 28, 2026 for affected iOS, iPadOS, and macOS releases. Apple indicated the flaw "may" have been used in an "extremely sophisticated" targeted attack against selected iOS users, but provided no technical details, IOCs, or delivery vector; defenders are advised to deploy patches immediately, prioritize high-risk users, preserve forensic artifacts, and monitor for suspicious crashes or follow-on activity.