Apple has released iOS 26.7.1 and iPadOS 26.7.1 with a single security fix for a vulnerability in CoreGraphics. The company says it is aware of a report that the bug may have been exploited in an extremely sophisticated attack against specific targeted individuals.
The fix is listed in Apple’s security support document, published earlier today. It arrived the same day as iOS 27.0.1, which fixes Face ID reboots on the iPhone 18 Pro and iPhone 18 Pro Max. Devices that have not moved to iOS 27 get iOS 26.7.1 instead.
The CoreGraphics Flaw Could Let a Malicious File Run Code
Apple describes the issue as an out-of-bounds write in CoreGraphics. Processing a maliciously crafted file may lead to arbitrary code execution, which means an attacker could run their own code on the device. Apple fixed it with improved bounds checking.
The security document gives these details for the release.
- CVE-2026-86950 is the only entry
- The affected component is CoreGraphics
- A crafted file can lead to arbitrary code execution
- Apple fixed it with improved bounds checking
- Apple credits Meta Product Security for the discovery
Apple’s wording points to targeted attacks, and the exploitation report covers versions of iOS before iOS 27. The company gives no details on who was targeted, how the attacks worked, or how many devices were involved. Apple’s stated policy is not to confirm security issues until patches are available.
iOS 26.7.1 Supports iPhone 11 and Later Plus iPads
The update is available for the following devices.
- iPhone 11 and later
- iPad Pro 12.9-inch 3rd generation and later
- iPad Pro 11-inch 1st generation and later
- iPad Air 3rd generation and later
- iPad 8th generation and later
- iPad mini 5th generation and later
The list is the same one Apple used for iOS 26.7. That release landed alongside the public launch of iOS 27 and patched more than 80 security vulnerabilities across the Kernel, WebKit, Bluetooth, and dozens of other frameworks. iOS 26.7.1 follows it with a much smaller patch.
Apple’s document covers only iOS 26.7.1 and iPadOS 26.7.1. Apple also released iPadOS 27.0.1 and visionOS 27.0.1 on September 28, 2026, for devices that have moved to the new version.
Anyone who has moved to iOS 27 can no longer downgrade to iOS 26, so this update is for people who chose to stay on iOS 26. To install it, open Settings, go to General, then tap Software Update. Automatic Updates can be switched on in the same menu.
