Apple Patches CoreGraphics Zero-Day Exploited in Targeted Attacks

Apple has released security updates to address a high-severity zero-day vulnerability in its CoreGraphics framework, tracked as CVE-2026-86950. The flaw, which carries a CVSS score of 8.8, allows for arbitrary code execution via maliciously crafted files. Apple confirmed that the vulnerability has been exploited in highly sophisticated, targeted attacks against specific individuals, including diplomats and journalists. The issue affects various iOS, iPadOS, and macOS versions. The company has implemented improved bounds checking to mitigate the risk. While Apple has not disclosed specific details regarding the threat actors, the discovery was credited to Meta Product Security. Users, particularly those in high-risk categories, are strongly urged to update their devices immediately to the latest software versions to protect against potential exploitation. This marks the second zero-day patch issued by Apple this year, following a significant number of similar incidents addressed throughout 2025.