Apple patches actively exploited CoreGraphics zero-day

Apple has released security updates closing a zero-day vulnerability that, according to the company, has already been used in "extremely sophisticated" targeted attacks on iOS devices.

The bug, tracked as CVE-2026-20700, is an out-of-bounds write — a flaw that lets data be written beyond an allocated memory buffer. It was reported by Meta Product Security in CoreGraphics, the framework responsible for two-dimensional vector graphics, image rendering, and text drawing across iOS, macOS, iPadOS, watchOS, and tvOS.

Why it matters

Out-of-bounds write flaws can crash a program, corrupt data, or, in the worst case, lead to remote code execution by writing outside the allocated memory. In Apple's wording, processing a maliciously crafted file could result in arbitrary code execution. The company addressed the problem with improved bounds checking.

Apple said it is aware of a report that the issue may have been exploited against specific targeted individuals on versions of iOS before iOS 27.

Who is affected

The list of impacted devices is extensive, spanning both older and newer models: iPhone 11 and later; iPad Pro (12.9-inch 3^rd generation and later, 11-inch 1^st generation and later); iPad Air 3^rd generation and later; iPad 8^th generation and later; iPad mini 5^th generation and later; and Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1.

The fix shipped in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. Even though the attacks appear narrowly targeted, Apple strongly urges users to install the updates promptly.

Not the first this year

This is the second in-the-wild zero-day Apple has patched since the start of the year. The earlier one, fixed in February, was an arbitrary code execution flaw in dyld — the dynamic linker used by Apple's operating systems — and was likewise abused in extremely sophisticated targeted attacks. Apple also fixed a Beats Studio Buds flaw this year that let attackers within Bluetooth range eavesdrop on conversations, and patched older iPhones and iPads against four vulnerabilities exploited in cyberespionage and crypto-theft campaigns using the Coruna exploit kit. Last year the company fixed seven more zero-days exploited in attacks.

Source: Bleeping Computer