Apple Patches CoreGraphics Zero-Day Exploited in Attacks

Apple released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 to fix CVE-2026-20700, a CoreGraphics out-of-bounds write that allows arbitrary code execution via malicious files. Meta Product Security found the flaw, which was exploited in extremely sophisticated attacks on a small number of people running older iOS versions. It is Apple's second zero-day exploited this year.