Apple Patches iPhone Zero-Day Used in Spy Attacks
Apple has released security updates fixing a zero-day vulnerability that was exploited in what the company called extremely sophisticated attacks against specific targeted individuals, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog.
Key facts
The flaw: CVE-2026-86950, an out-of-bounds write in CoreGraphics, found by Meta Product Security
The risk: Processing a maliciously crafted file may lead to arbitrary code execution
Who was attacked: Specific targeted individuals on versions of iOS before iOS 27
The fixes: iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1
Status: Added to CISA's Known Exploited Vulnerabilities catalog on September 30, 2026
Apple's second exploited zero-day this year
Which devices are affected?
The list is long and includes older hardware: iPhone 11 and later; iPad Pro 12.9-inch 3rd generation and later; iPad Pro 11-inch 1st generation and later; iPad Air 3rd generation and later; iPad 8th generation and later; iPad mini 5th generation and later; and Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1.
CoreGraphics is the framework handling two-dimensional graphics, image rendering and text drawing across iOS, macOS, iPadOS, watchOS and tvOS — which is why the affected device list is essentially everything.
How does the attack work?
Through a file. Apple's advisory states that processing a maliciously crafted file may lead to arbitrary code execution, and that the issue was an out-of-bounds write addressed with improved bounds checking.
An out-of-bounds write happens when software writes data past the end of the memory space it was given. Exploiting one can crash a program, corrupt data, or in the worst case let an attacker run their own code on the device.
Because the vulnerable component renders images and text, the malicious file is typically something a device opens automatically or that a user opens without thinking.
Should ordinary users worry?
Mostly no, but update anyway.
Apple described the exploitation as extremely sophisticated attacks against specific targeted individuals — the language it uses for commercial spyware and state-linked operations, which typically target journalists, activists, dissidents and government officials rather than the general public.
Two reasons to install the update regardless: once a flaw is patched, its details become available to researchers and attackers alike, and the pool of people exploiting it widens; and if you are in a category that attracts targeted attention, you are exactly who this was built for.
To update: Settings, then General, then Software Update on iPhone or iPad. On a Mac, System Settings, then General, then Software Update.
How does this fit Apple's year?
This is the second zero-day exploited in the wild that Apple has fixed in 2026. The first, CVE-2026-20700, was an arbitrary code execution flaw in dyld, the Dynamic Link Editor used by Apple operating systems, also exploited in extremely sophisticated targeted attacks and patched in February.
Apple fixed seven such zero-days during the previous year. The steady cadence reflects an active commercial market for iPhone exploits rather than declining security.