Exploited Apple CoreGraphics flaw lets a malicious file run code on iPhones, iP…

What happened

Apple has fixed a serious bug in CoreGraphics, the part of iPhones, iPads and Macs that draws graphics and handles images and PDF documents. Tracked as CVE-2026-86950, the flaw allows a specially crafted file to run an attacker’s code on the device. It was reported by Meta Product Security.

Apple shipped the first fixes on September 28, 2026, in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. On October 26, 2026, it extended the fix to older iPhones and iPads with iOS 18.7.11 and iPadOS 18.7.11.

Attackers have most likely already used the flaw. Apple says it is aware of a report that the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. The US agency CISA added it to its catalog of actively exploited vulnerabilities on September 29, 2026, and the EU agency ENISA lists it as EUVD-2026-88445.

Why it is dangerous

This is an out-of-bounds write bug. Picture a paper form where every box has a fixed length. If a program does not check whether the text fits, it spills over into the neighboring boxes. Someone who knows exactly what to write and where can use that spill to slip the program their own instructions. Here, all it takes is for the device to process a maliciously crafted file.

The attacker needs no password and no physical access. The file can arrive over the internet, for example by email, in a message or through a web page. The rating assumes some user involvement, typically opening or viewing the file. If the attack succeeds, the attacker runs their own code on the device. Apple has not said what exactly they could do from there.

CVSS 8.8 out of 10 (CVSS 3.1, CISA score listed in NVD): high severity. CVSS is the standard 0 to 10 scale for how serious a flaw is and how easy it is to abuse.
CISA KEV: a catalog run by the US agency CISA that only lists flaws with evidence of real-world exploitation. US federal agencies had to patch it by October 13, 2026.
EPSS 26% (as of October 28, 2026): an estimate of the chance the flaw will be exploited in the next 30 days. That puts it in roughly the top 2% of all known vulnerabilities.

According to Apple, the flaw may have been exploited in a targeted attack on specific people rather than in a mass campaign. Once a fix is public, though, other attackers can study the flaw too, so it is worth updating every device, not just the “important” ones.

Who is affected

The flaw affects iPhones, iPads and Macs that are not yet on a fixed version:

iOS and iPadOS 18 before 18.7.11. Apple released this version for iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
iOS and iPadOS 26 before 26.7.1. The fix covers iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later.
macOS Tahoe before 26.7.1.
macOS Sequoia before 15.8.1.

In a small business this usually means company phones and laptops used by management, sales or accounting, plus personal devices where staff read work email. Apple has not said who the victims were. The reported exploitation involves iOS versions before iOS 27. For Macs, Apple’s security notes for this flaw list only macOS Tahoe and macOS Sequoia.

How to check if you are affected

On an iPhone or iPad, open Settings > General > About and look at the iOS or iPadOS version. On a Mac, click the Apple menu > About This Mac. You can also check the macOS version in Terminal with a read-only command that changes nothing:

sw_vers

Look for the ProductVersion line, for example 15.8.1. If you manage devices through an MDM such as Microsoft Intune or Jamf, its inventory view shows the version of every device. A device is fine if it runs the fixed version for its system line or anything newer.

How to fix it

The fixed versions are iOS and iPadOS 18.7.11, iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, or anything newer. Apple lists no workaround, so updating is the only protection. Suggested order:

Start with the people attackers would most want to reach: management, anyone with access to finances, sensitive data or admin accounts, and frequent travelers.
iPhone and iPad: Settings > General > Software Update, then Download and Install. Keep the device charging and on Wi-Fi.
Mac: System Settings > General > Software Update. Make sure you have a current backup first, for example with Time Machine.
In your MDM, enforce the update with a short deadline and track which devices are still missing it.
After updating, confirm the version as described in the previous section.

Devices that support iOS 27 can also move to the latest iOS 27 release. Apple says the reported exploitation involved versions before iOS 27. Devices that no longer receive Apple updates should not be used for company data.

What if you may already be compromised

Neither Apple nor CISA has published specific indicators of compromise such as file names or server addresses. Apple describes the attack in which the flaw may have been exploited as extremely sophisticated and targeted. Attacks like that are hard to spot with everyday tools. It is still worth checking:

Whether anyone in the company received an Apple threat notification. Apple sends it by email, and it also appears on the iPhone itself and after signing in at account.apple.com.
Settings > General > VPN & Device Management for profiles you do not recognize.
The list of signed-in devices in the Apple Account settings, removing any you do not know.
On a Mac, System Settings > General > Login Items & Extensions, plus any unfamiliar apps.
Odd behavior such as fast battery drain, overheating or unexpected restarts. On its own, this proves nothing.

Call in a specialist if the device belongs to someone in a sensitive role, if Apple sent a threat notification, or if you have other reasons for suspicion. Until then, do not wipe or restore the device, so evidence is preserved. Change passwords for company accounts from a different, trusted device.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.

Exploited Apple CoreGraphics flaw lets a malicious file run code on iPhones, iPads and Macs