Summary
Apple has patched CVE-2026-54085, a CVSS 8.8 memory corruption vulnerability in CoreGraphics that is being actively exploited in targeted attacks against iPhone, iPad, and Mac users. The vulnerability can be triggered by processing a maliciously crafted image or PDF file, making delivery through email attachments, web content, and messaging apps viable attack vectors. Emergency patches are available for iOS 19.1, iPadOS, and macOS.
Timeline
| Date | Event |
|---|---|
| Sep 29, 2026 | Apple patches CVE-2026-54085 in iOS 19.1, iPadOS, and macOS; active exploitation in targeted attacks confirmed |
What Happened
CoreGraphics is the rendering framework used across all Apple platforms for displaying images, PDFs, and other visual content. A memory corruption vulnerability in CoreGraphics can be triggered when the framework processes a maliciously crafted file, potentially allowing an attacker to execute arbitrary code. When chained with a privilege escalation vulnerability, this class of bug can achieve full device compromise from a single malicious file delivered through any channel that causes CoreGraphics to render untrusted content.
The CVSS 8.8 score and confirmed targeted exploitation pattern are consistent with commercial spyware deployment by nation-state customers. Users should apply the iOS 19.1 and macOS updates immediately.
Domain Intelligence
apple.com — 70.56
apple.com scores at 70.56. Apple is the vendor of the affected platforms and the party that released the emergency patches.