Apple released iOS 26.7.1 and iPadOS 26.7.1 on September 28, 2026. The update closes a CoreGraphics flaw tracked as CVE-2026-86950. Apple says the flaw may already have been used against specific people. If your iPhone or iPad is still on the iOS 26 branch, install this one now.
Our report on iOS 27.0.1 noted that devices on the older track would get 26.7.1 instead. That was a passing mention of the version number. The two updates do different jobs. iOS 27.0.1 fixes the Face ID reboot bug on iPhone 18 Pro. This one is a security patch for anyone who has not moved to iOS 27.
What Apple says about the flaw
Apple’s security notes describe an out-of-bounds write in CoreGraphics, fixed by tightening bounds checking. The risk is arbitrary code execution when a device processes a maliciously crafted file. Apple then adds:
Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
Apple’s notes do not say who was targeted, or by whom. They credit researchers at Meta Product Security with reporting the flaw. The 27.0.1 releases that shipped the same day are not listed as affected.
Which devices can install iOS 26.7.1
Apple’s support page lists the hardware covered by iOS and iPadOS 26.7.1:
- iPhone: iPhone 11 and later
- iPad Pro: 12.9-inch 3rd generation and later, and 11-inch 1st generation and later
- iPad Air: 3rd generation and later
- iPad: 8th generation and later
- iPad mini: 5th generation and later
Macs get the same fix
Apple shipped matching builds for two Mac branches on the same day. macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 each carry their own security content page. If you are holding back from the newest macOS release, those are the builds to install.
Why it is worth doing today
Attacks written up in this language target a small number of people, not the general public. That does not make the patch optional. Once a flaw is documented, the technique behind it tends to get reused more broadly. The update installs through Settings, then General, then Software Update.
Sources: Apple (iOS 26.7.1), Apple (macOS Tahoe 26.7.1), Apple (macOS Sequoia 15.8.1), first reported by MacRumors
