Skip to content

Back to the catalog

support.apple.comadvisory

About the security content of iOS 26.7.1 and iPadOS 26.7.1

Apple's official security content page for iOS 26.7.1 and iPadOS 26.7.1, released September 28, 2026, patching a single CoreGraphics vulnerability (CVE-2026-86950), an out-of-bounds write triggered by processing a maliciously crafted file, leading to arbitrary code execution. Apple states it is aware of a report that the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27, with the issue reported by Meta Product Security.

TL;DR Apple patches an exploited in the wild CoreGraphics zero-day (CVE-2026-86950) used in a targeted spyware-style attack, fixed in iOS/iPadOS 26.7.1.
Open original ↗

Organisations named here

  • Meta Product Security

CVEs named here

  • CVE-2026-86950

Technologies named here

  • iOS
  • iPadOS
  • iPhone 11 and later
  • iPad Pro 12.9-inch 3rd generation and later
  • iPad Pro 11-inch 1st generation and later
  • iPad Air 3rd generation and later
  • iPad 8th generation and later
  • iPad mini 5th generation and later
  • CoreGraphics

Techniques named here

  • Out-of-bounds write

Related in Mobile Security