Apple CoreGraphics zero-day CVE-2026-86950: update iPhone, iPad, and Mac now

If your iPhone, iPad, or Mac is still on iOS / iPadOS 26 or macOS Tahoe / Sequoia, install Apple’s September 28, 2026 point releases today. This is not a “when I have a free evening” update. It patches CVE-2026-86950, a CoreGraphics out-of-bounds write that Apple says may already have been used in a highly targeted attack.

Apple’s security notes for iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 all describe the same CoreGraphics fix. The CVE record tracks it as well. Impact wording from Apple: processing a maliciously crafted file may lead to arbitrary code execution. Apple also says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

You do not need to be a celebrity target for that sentence to matter. A patched CoreGraphics bug that can fire while a file is processed is the kind of hole you close on every device you own.

This post is for people who stayed on the 26 / 15 trains. It is distinct from iOS 27.0.1 (the Face ID stability package for people already on iOS 27). It is also a follow-up to the earlier Tahoe 26.7 / Sequoia 15.8 security note. Those September 14 builds are not enough once 26.7.1 and 15.8.1 exist.

What CVE-2026-86950 is (plain English)

CoreGraphics is Apple’s 2D drawing and PDF-related plumbing. The bug is an out-of-bounds write fixed with improved bounds checking. In practice: a bad file can push the graphics stack into memory it should not touch. Apple credits Meta Product Security on the advisory pages.

Public research coverage (including SecurityAffairs and The Hacker News) describes a circulating proof-of-concept that uses a malicious PDF with a crafted embedded font. Important nuance for home readers: that material demonstrates a crash, not a finished remote-control exploit. Turning memory corruption into reliable code execution is separate work. Still, a public crash recipe raises the urgency of installing Apple’s fix. Do not download sample PDFs “to see if you are vulnerable.” Update instead.

Who needs which build

Match the major you are already on. Do not treat these as one interchangeable package.

• iPhone still on iOS 26 (iPhone 11 and later, per Apple’s note): install iOS 26.7.1.
• iPad still on iPadOS 26 (models listed in Apple’s 26.7.1 note, including recent iPad Pro, iPad Air, iPad, and iPad mini lines): install iPadOS 26.7.1.
• Mac on macOS Tahoe 26.x: install macOS Tahoe 26.7.1.
• Mac on macOS Sequoia 15.x: install macOS Sequoia 15.8.1.

If you already moved to iOS 27 (or iPadOS 27 / macOS 27), you are on a different release train. Keep installing the 27.x updates Apple offers for your device. The Face ID reboot fix for iPhone 18 Pro is covered in our iOS 27.0.1 note, and the earlier “fix coming” story is here. Staying on 26 without 26.7.1 is the risky stay-put path this article is about.

Install on iPhone and iPad

1. Plug in (or keep the battery comfortable) and join a reliable Wi-Fi network.
2. Open Settings → General → Software Update.
3. Install 26.7.1 when offered for your current major.
4. Let the phone or tablet restart when the update finishes.
5. Confirm under Settings → General → About that the version line shows 26.7.1.

If Software Update is empty the first time you check, wait and look again. Apple stages files. Do not chase random IPSW links from social media.

Install on Mac

1. Plug in a laptop. Prefer a stable network.
2. Open System Settings → General → Software Update.
3. Install the point release for your major:
   • Tahoe: 26.7.1
   • Sequoia: 15.8.1
4. Restart when macOS asks. Leaving the reboot for later leaves the old frameworks running.
5. Confirm under System Settings → General → About that the version matches.

Repeat on every Mac in the house that stayed on Tahoe or Sequoia, not just the one on your desk.

Do this / don’t do that

Do

• Install the September 28 point release that matches your current major, then verify About.
• Update every personal Apple device still on 26 / 15, including a shared family iPad or living-room Mac.
• Treat unexpected PDFs and weird file attachments carefully until you are patched (and honestly, after as well).
• Keep installing later 26.7.x / 15.8.x builds if Apple supersedes these numbers.

Don’t

• Do not assume September’s 26.7 / 15.8 builds already covered this CVE. You want 26.7.1 or 15.8.1.
• Do not confuse this security train with iOS 27.0.1. Different major, different package.
• Do not download public “test” PDFs or PoC samples to prove the bug on your own phone.
• Do not leave the restart pending overnight because the download finished.

Bottom line

Apple released iOS / iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 on September 28, 2026 to fix CVE-2026-86950, a CoreGraphics out-of-bounds write that may have been exploited in an extremely sophisticated attack against specific targeted individuals on older iOS versions (iOS/iPadOS note, Tahoe, Sequoia, CVE). Public crash PoC coverage exists; updating is still the whole home-user job. On phone or tablet: Settings → General → Software Update, then confirm About. On Mac: System Settings → General → Software Update, restart if asked, confirm About. If you already jumped to iOS 27, stay on that train and see the 27.0.1 Face ID fix.

Image: Apple logo art (apple.com/newsroom).