Apple addresses COREGRAPHICS vulnerability: a threat to crypto users

Apple has released updates to address a vulnerability in CoreGraphics, tracked as CVE-2026-86950. This vulnerability could have been used in targeted attacks. The update, affecting devices with iOS, iPadOS, and macOS, was introduced on September 28, with versions iOS 26.7.1 and iPadOS 26.7.1. According to the company, the vulnerability allows arbitrary code execution when processing a specially crafted file. CVE-2026-86950 was described as an out-of-bounds write issue that allows software to write data outside the allocated memory area. Apple reported that the vulnerability could have been used in a "highly sophisticated attack against specifically targeted users" who used iOS versions released before iOS 27. The security mechanism has been improved to prevent such attacks. Apple noted that Meta Product Security reported the issue.

The security of cryptocurrency users also attracted attention, as the research firm SlowMist pointed out the importance of the update. They warn that recent attacks on iOS could have targeted cryptocurrency wallet data. Despite this, Apple has not confirmed that CVE-2026-86950 was used to steal cryptocurrency or access wallet data. It is important to note that firms like SlowMist have investigated other vulnerability cases, such as the FomoPeek app, which could exploit several iOS vulnerabilities to access users' protected data.

Security updates were released not only for mobile devices. The CoreGraphics vulnerability was also fixed in macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1. Users with devices such as iPhone 11 and later models, as well as various iPad models, are advised to install the latest update. For users who may have previously encountered malware, installing the update will not restore access to previously exposed personal data, such as recovery phrases or private keys. The persistent focus on cryptocurrency data security highlights the high risk associated with vulnerabilities in mobile applications, especially in the context of recent attacks on cryptocurrency users.