Malicious files can run code on iPhones, iPads and Macs through CoreGraphics (CVE-2026-86950)

25 October 2026High 8.8Being exploited

Apple · iOS, iPadOS and macOS · CVE-2026-86950

Malicious files can run code on iPhones, iPads and Macs through CoreGraphics

An out-of-bounds write in CoreGraphics means processing a malicious file may lead to code running on the device. Apple says it is aware of a report that it may have been used in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27. These updates bring the fix to devices still on iOS 26 and older macOS releases.

Affected: iOS and iPadOS 26 before 26.7.1 (iPhone 11 and later, and supported iPads), macOS Tahoe before 26.7.1 and macOS Sequoia before 15.8.1.
What to do: Update iPhones and iPads to the latest iOS or iPadOS (26.7.1 or later on the 26 line); update Macs to macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1. Turn on automatic updates on company devices.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Exploited in targeted attacks; on CISA's KEV list; staff phones and Macs are part of every small business's attack surface.

Malicious files can run code on iPhones, iPads and Macs through CoreGraphics

Affected

iOS and iPadOS 26 before 26.7.1 (iPhone 11 and later, and supported iPads), macOS Tahoe before 26.7.1 and macOS Sequoia before 15.8.1.

What to do

Update iPhones and iPads to the latest iOS or iPadOS (26.7.1 or later on the 26 line); update Macs to macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1. Turn on automatic updates on company devices.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Exploited in targeted attacks; on CISA's KEV list; staff phones and Macs are part of every small business's attack surface.