Apple patched a CoreGraphics bug it says may already have been used

I read The Hacker News on September 29, 2026. Apple shipped fixes for older iOS, iPadOS, and macOS.

The identifier is CVE-2026-86950. Apple puts it in CoreGraphics and describes an out-of-bounds write. They say it may already have been used in attacks aimed at specific people, and that a file built to trip the bug can run code the sender chooses.

I do not have a how-to, and I am not writing one. If a phone or Mac is still on the older version they named, the vendor update is the move.

Source I used: The Hacker News. The link is under this column.