Summary
Apple’s iOS 26.7.1 and iPadOS 26.7.1 address a CoreGraphics vulnerability that could allow arbitrary code execution. Apple says it is aware of a report of highly sophisticated exploitation against specific targeted individuals.
Apple released iOS 26.7.1 and iPadOS 26.7.1 on September 28, 2026, to fix a vulnerability in CoreGraphics. Apple says processing a maliciously crafted file could lead to arbitrary code execution, and that it is aware of a report of an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
The fix applies to iPhone 11 and later, iPad Pro 12.9-inch (3rd generation and later), iPad Pro 11-inch (1st generation and later), iPad Air (3rd generation and later), iPad (8th generation and later), and iPad mini (5th generation and later).
What the CoreGraphics fix addresses
Apple describes the underlying issue as an out-of-bounds write and says it addressed it with improved bounds checking. An out-of-bounds write occurs when software writes data beyond the memory area intended for it. Depending on the circumstances, that can corrupt other data; Apple identifies arbitrary code execution as the potential impact of this flaw.
CoreGraphics is part of Apple’s graphics software stack. The advisory links the risk to processing a maliciously crafted file, but does not describe the file format or the reported attack in further technical detail.
The vulnerability is listed as CVE-2026-86950, with credit to Meta Product Security. Apple’s wording is that it is aware of a report of exploitation, and characterizes the reported attack as highly sophisticated and directed at specific individuals.