Apple fixes a CoreGraphics flaw it says may have been exploited, in iOS 26.7.1 and macOS 26.7.1

Apple has released iOS 26.7.1 and iPadOS 26.7.1, along with macOS Tahoe 26.7.1, to fix a security flaw in CoreGraphics, the part of the system that handles drawing and image files (CVE-2026-86950).

Apple says processing a maliciously crafted file could lead to arbitrary code execution, meaning an attacker’s code could run on the device. Apple also says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. Apple describes the fix as improved bounds checking for an out-of-bounds write.

Who it affects

Apple lists the iOS and iPadOS update for iPhone 11 and later, and for a range of iPad Pro, iPad Air, iPad and iPad mini models (Apple’s page has the full list). The macOS update is listed for macOS Tahoe. Apple notes that the reported exploitation involved iOS versions before iOS 27.

What Apple’s pages cover

Apple’s security content pages describe the issue, its impact and the devices the update is available for. They don’t include step-by-step instructions; the fix is delivered by installing the 26.7.1 update through the normal software update setting on each device.

Our iPhone security basics and Mac security basics guides explain how software updates work on Apple devices, step by step, based on Apple’s own instructions.