Apple iOS, iPadOS, and macOS CoreGraphics out-of-bounds write can lead to arbitrary code execution

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

• Apple iOS and iPadOS: the supplied affected status is versions < 26.7.1; Apple identifies 26.7.1 as the fixed release. Apple's advisory lists iPhone 11 and later and specified iPad generations as supported by this update.
• Apple macOS Sequoia: versions < 15.8.1 are affected; Apple identifies 15.8.1 as the fixed release.
• Apple macOS Tahoe: versions < 26.7.1 are affected; Apple identifies 26.7.1 as the fixed release.
• Apple's note about possible exploitation on iOS versions before iOS 27 is threat-status information and does not replace the structured affected boundaries above. The supplied evidence does not establish the status of parallel Apple OS branches or other release branches beyond those listed.

Apple identifies the affected component as CoreGraphics, where an out-of-bounds write was addressed through improved bounds checking. The attacker-controlled input is a maliciously crafted file, and processing that file may lead to arbitrary code execution. The record characterizes the path as network-reachable, requiring no privileges, having low complexity, and requiring user interaction, but it does not explain how the file reaches the device or how it is opened. Apple does not disclose the file format, code path, memory conditions, or exploitation primitive, so a detailed exploit chain should not be inferred from the available description.

The record describes network reachability, no authentication or privileges, and required user interaction. Apple says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals using older iOS versions. The supplied record marks the vulnerability as known exploited and as having a public exploit, but it provides no payload, exploit chain, delivery method, or evidence that every device was targeted. Public technical detail about exploitation remains limited.

The technical outcome described by Apple is that processing a malicious file may result in arbitrary code execution. If achieved, the code could run with the privileges available to the file-processing process and may affect device or data confidentiality, integrity, and availability; this is a possible consequence, not evidence of a specific compromise. The record does not establish privilege escalation, sandbox escape, persistence, remote access without user interaction, or lateral movement. Apple has only stated that a report described an extremely sophisticated attack against specific targeted individuals, so actual impact depends on the device, data, and other security controls.

If exploitation succeeds, an attacker may execute arbitrary code on the device or within the affected file-processing process. This could result in loss of confidentiality, data modification, or service disruption depending on the process privileges and remaining security controls.

• Devices that process untrusted files could become an entry point for a targeted attack.
• Code execution could enable follow-on activity on the endpoint, but the available evidence does not confirm sandbox escape, privilege escalation, persistence, or lateral movement.
• Apple describes the reported exploitation as targeting specific individuals; the available evidence does not establish a widespread incident or ransomware campaign.

1. Update each product branch to its confirmed fixed release: update iOS and iPadOS to 26.7.1, macOS Sequoia to 15.8.1, and macOS Tahoe to 26.7.1. Do not assume that a fix confirmed for one branch automatically applies to every other branch.
2. On iPhone or iPad, install the update through Software Update or another Apple-supported update mechanism, then verify the version under Settings > General > About. On macOS, use Software Update, the Mac App Store, or Apple's software download channel.
3. Prioritize devices that can receive files from untrusted sources or are used by users likely to be targeted, because the supplied record indicates exploitation has occurred.
4. If an update cannot yet be installed, treat the device as still exposed and use the organization's exception-management process. The available evidence does not identify an Apple-confirmed workaround, so an inferred control should not be treated as a substitute for patching.

Checks should focus on device update state and handling of untrusted files:

1. Inventory iPhone, iPad, and Mac devices running Apple OS branches that include CoreGraphics, recording the actual OS branch and installed version.
2. Compare each device with the affected and fixed boundaries in affected_summary; normal device operation is not evidence that the device is safe.
3. On iPhone or iPad, confirm the installed version after updating under Settings > General > About. On Mac, verify that the operating system update completed through Apple's update mechanism.
4. As a precaution, review endpoint telemetry for unexpected execution behavior following the handling of untrusted files. Apple does not provide a specific IOC, log pattern, or forensic signature in the advisories used for this entry.
5. If an unpatched device shows suspicious file-processing activity, preserve relevant logs and follow the organization's incident response process. Do not treat an absence of alerts as proof that exploitation did not occur.