Apple patched a CoreGraphics flaw possibly exploited in targeted attacks

What happened

Apple fixed an out-of-bounds write in CoreGraphics, the system's 2D graphics engine, and said it may have been exploited in an extremely sophisticated attack against specific targeted individuals.

Apple has not published how the flaw was exploited or who was targeted.

What was found

The fix shipped in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Meta's product security team reported the flaw. A proof of concept appeared on October 1, but according to reports it only crashes the program and does not show a working attack.

Data at risk

• Not disclosed by Apple

What you should do

1. 1Update to iOS 26.7.1 or later right away.
2. 2Keep automatic updates turned on.