Apple’s latest security update has addressed a critical vulnerability that was being exploited in targeted attacks on iOS devices. The issue, tracked as CVE-2026-20700, lies within Apple’s CoreGraphics framework, which is responsible for rendering two-dimensional vector graphics, images, and text across various Apple operating systems.
The flaw is an out-of-bounds write weakness, allowing attackers to potentially execute arbitrary code or crash applications by writing data outside the allocated memory buffer. In a statement, Apple warned that this issue may have been exploited in “extremely sophisticated” attacks against specific individuals on older iOS versions before 27.
A wide range of Apple devices are affected, including iPhones from iPhone 11 onwards and iPads from iPad Pro 12.9-inch 3rd generation and later. Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1 also need to install the latest security updates to prevent potential exploitation.
Apple’s patch for CVE-2026-20700 involves improved bounds checking, a measure designed to prevent data from being written outside designated memory areas. The update is available as part of iOS 26.7.1 and iPadOS 26.7.1 for iPhones and iPads, respectively, as well as macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 for Macs.
This vulnerability marks the second zero-day flaw addressed by Apple in 2026, following a similar issue in February that also involved arbitrary code execution. The company has been proactive in addressing such vulnerabilities, with multiple fixes released over the past year to protect users from targeted attacks and malware exploitation.
It’s essential for all affected device owners to install these security updates promptly to prevent potential ongoing attacks. Even if you’re not directly targeted, keeping your devices up-to-date can help protect against other potential threats lurking in the wild.
To stay ahead of emerging threats, it’s crucial to prioritize regular software updates and ensure that your Apple devices are running the latest operating systems. This will provide an added layer of security and peace of mind, especially as attacks continue to evolve with increasingly sophisticated tactics.
Source: Bleeping Computer — 2026-09-29