Apple has released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 to address a security vulnerability that Apple believes was used in targeted attacks. The flaw affects CoreGraphics, a system framework used to process graphics and image content.

According to Apple’s security advisories, a maliciously crafted file could trigger an out-of-bounds write in CoreGraphics. Successful exploitation could allow an attacker to execute arbitrary code on a vulnerable device. Apple fixed the issue by improving the software’s bounds checking.

What the Apple security updates fix

Apple describes the issue as a CoreGraphics vulnerability and says it was exploited in an “extremely sophisticated attack” against a small number of people running older versions of iOS. The company has not indicated that the attack was widespread.

Because the vulnerability can be reached through a specially created file, opening malicious content may have been enough to expose an unpatched device. Apple’s advisories identify the affected products and document the security fix, but do not provide additional details about the attackers or the targeted individuals.

  • iOS 26.7.1: fixes the CoreGraphics out-of-bounds write issue.
  • iPadOS 26.7.1: includes the same security correction for compatible iPad models.
  • macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1: address the vulnerability on supported Macs.

Are newer Apple operating systems affected?

Apple’s current operating system releases do not appear to be affected by the vulnerability described in the advisories. The iOS 27.0.1, iPadOS 27.0.1, and macOS Golden Gate 27.0.1 updates released at the same time do not have published CVE entries for this issue.

That distinction suggests the vulnerability is relevant primarily to users who remain on the older software branches covered by Apple’s security notices. However, the absence of a listed entry for the newer releases does not change the need to update older supported devices.

Why users should update now

Apple’s disclosure means that information about the flaw is now public. Even though the original exploitation was limited and highly targeted, other attackers could study the details and attempt to use the vulnerability against devices that have not installed the patches.

Users running iOS 26, iPadOS 26, macOS Tahoe, or macOS Sequoia should install the applicable update as soon as possible. Keeping these devices current reduces the risk posed by malicious files and ensures that the CoreGraphics bounds-checking fix is in place.