Apple has released a patch for a CoreGraphics zero-day vulnerability that was reportedly exploited in targeted attacks before the fix became available.

The flaw, identified as CVE-2026-86950, is an out-of-bounds write issue within Apple's CoreGraphics framework, which handles graphic rendering across iOS, iPadOS, macOS and related platforms. According to Apple's security advisory, processing a specially crafted file could enable arbitrary code execution on affected devices.

Apple confirmed awareness of limited exploitation against specific individuals using iOS versions prior to iOS 27. The company did not disclose the number of victims, the identities of those targeted, or the groups potentially responsible for the attacks. No public details have emerged regarding the method of exploitation or the initial access vector.

Meta's Product Security team reported the vulnerability to Apple. Neither Apple's advisory nor Meta has released technical specifics about how the flaw was discovered or the nature of the attacks in which it may have been used.

The patch was incorporated into iOS 26.7.1 and iPadOS 26.7.1, released on Monday. Affected devices include iPhone 11 and later models, iPad Pro 12.9-inch (third generation and later), iPad Pro 11-inch (first generation and later), iPad Air (third generation and later), iPad (eighth generation and later), and iPad mini (fifth generation and later). Apple noted the exploited versions were those released before iOS 27, though it has not specified exact prior versions.

This vulnerability marks the seventh zero-day flaw addressed by Apple in 2026 following similar patched issues earlier in the year. The company's advisory recommends users update promptly to mitigate potential risks.

While the scope of exploitation appears limited, the incident underscores ongoing efforts by threat actors to identify and weaponize platform-specific vulnerabilities before public disclosure. Regular software updates remain the primary defense against such threats.