GoKawiilApple fixes CoreGraphics zero-day used in targeted iPhone attacks
Apple has issued security updates for CVE-2026-20700, an out-of-bounds write flaw in its CoreGraphics framework that was used in what the company calls an 'extremely sophisticated' attack against specific individuals. The bug, found by Meta Product Security, affects iOS, iPadOS, macOS, watchOS and tvOS, and could let a malicious file trigger arbitrary code execution. Fixes are included in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw's exploitation against 'specific targeted individuals' suggests spyware-style surveillance rather than mass exploitation, a pattern often associated with mercenary spyware operators. This marks the second in-the-wild zero-day Apple has patched this year, indicating attackers continue to find ways into Apple's core rendering and system frameworks despite its hardened defenses. Users, especially high-risk individuals like journalists or activists, are advised to update promptly given the broad range of affected devices.
- CVE-2026-20700 is an out-of-bounds write bug in Apple's CoreGraphics framework.
- It was exploited in a sophisticated targeted attack, discovered by Meta Product Security.
- Apple has released patches across iOS, iPadOS, and macOS to close the flaw.
Apple iPhone 17 — Since this zero-day affects a wide range of older iPhones, upgrading to the latest iPhone 17 ensures you're running the newest iOS with the most current security patches and hardware protections. Staying current on both hardware and software is one of the best defenses against sophisticated targeted exploits like this CoreGraphics flaw.
See Apple iPhone 17 on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-29
Published there as: “Apple patches CoreGraphics zero-day flaw exploited in attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.