iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 address a CoreGraphics vulnerability that Apple says was used against a small number of targeted individuals.
Apple’s security support pages state the issue was an out-of-bounds write in CoreGraphics that could be triggered by a maliciously crafted file, potentially allowing arbitrary code execution. The bug has been fixed with improved bounds checking.
Apple said the flaw was exploited in an ‘extremely sophisticated attack’ on targeted individuals running older versions of iOS. The company indicates that its latest operating systems do not appear to be affected.
The iOS 27.0.1, iPadOS 27.0.1 and macOS Golden Gate 27.0.1 updates that came out today have no published CVE entries and, according to Apple, are not impacted by this specific vulnerability.
If you are still running a release from the iOS 26 or iPadOS 26 lines, or macOS Tahoe or Sequoia, install the new updates as soon as possible. Now that details of the vulnerability are public, Apple warns it could be further exploited against users who remain unpatched.
iOS 26.7.1 and related updates
The 26.7.1 family of updates targets the CoreGraphics out-of-bounds write and applies the same improved bounds checking fix across iOS, iPadOS and the cited macOS releases. Apple attributes the prior exploitation to a narrow, targeted campaign rather than a widespread attack.
