Apple fixes CoreGraphics zero-day CVE-2026-86950
Apple has shipped security updates for a zero-day vulnerability in CoreGraphics that was exploited in what the company describes as "extremely sophisticated" attacks against iOS users.
The flaw, tracked as CVE-2026-86950, was reported by Meta Product Security. It is an out-of-bounds write bug in CoreGraphics, the framework Apple uses for two-dimensional vector graphics, image rendering and text drawing. The framework is shared across iOS, macOS, iPadOS, watchOS and tvOS.
A crafted file is enough
Out-of-bounds write bugs happen when a program writes data outside the memory buffer it was given. Depending on how they are exploited, they can crash an application, corrupt data or, in the worst case, let an attacker run code remotely.