Apple has patched an iPhone security flaw that could allow attackers to run their own code through a maliciously crafted file, while warning that the vulnerability may already have been used against targeted individuals.
The risk has drawn particular attention from blockchain security researchers because recent iOS attacks have shown how high-level device access can expose cryptocurrency wallet data.
Apple Patches iPhone Zero-Day Linked To Targeted Attacks
Apple released iOS 26.7.1 and iPadOS 26.7.1 on 28 September 2026 to fix CVE-2026-86950, an out-of-bounds write vulnerability in CoreGraphics, the framework used to process and render graphical content.
The flaw could be triggered when a device processes a specially crafted file.
Apple said the issue could lead to arbitrary code execution, meaning an attacker could potentially use the vulnerability to run their own code on the affected device.
The company also disclosed that it was “aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.”
Apple credited Meta Product Security with reporting the vulnerability.
The company has not disclosed the file format used in the reported attacks, the identities of the targets or how the malicious files were delivered.
It also has not linked the activity to a particular hacking group, commercial surveillance company or financially motivated attacker.
How Can A Malicious File Compromise An iPhone?
CVE-2026-86950 is an out-of-bounds write flaw, which occurs when software writes data beyond the memory area allocated to it.
In this case, a specially crafted file could cause CoreGraphics to write outside its assigned memory space.
Attackers can potentially abuse this type of flaw to corrupt memory and eventually execute code on a device.
That creates a risk even when a victim has not deliberately installed malicious software.
If the vulnerable system processes the crafted file, the attacker may gain an opportunity to exploit the device.
Apple has described the vulnerability as potentially exploited against targeted individuals, but has not provided enough technical detail to establish how the reported attacks worked.
The wording indicates that attackers may have used the flaw before Apple released a fix, which is commonly associated with a zero-day vulnerability, although Apple did not itself use that label in its advisory.
Why Crypto Wallet Users Are Paying Attention
The Apple patch has attracted additional attention from SlowMist because of the potential consequences of gaining deeper access to an iPhone used for cryptocurrency.
SlowMist has warned that recent iOS exploitation activity has targeted sensitive wallet information.
The security firm has not, however, provided evidence that CVE-2026-86950 was used in any known cryptocurrency theft.
The concern is instead linked to what attackers could potentially access after compromising a device.
Depending on how a device is configured, high-level access could expose wallet application data, private keys, seed phrases stored locally, credentials or two-factor authentication information.
For self-custodied crypto users, the consequences can be particularly serious because a private key or seed phrase that has already been exposed cannot simply be reset like a conventional password.
FomoPeek Shows How iOS Attacks Can Reach Wallet Data
The warning comes after several separate iOS security incidents involving cryptocurrency users.
One example is FomoPeek, an iOS application investigated following reports of cryptocurrency losses and private-key exposure.
Security researchers found malicious versions of FomoPeek containing an iOS kernel exploitation framework designed to work across several iOS versions.
The framework could potentially bypass Apple's application sandbox and access information normally isolated from other apps, including Keychain records, private keys, seed phrases, account credentials and locally stored files.
The FomoPeek incident is separate from CVE-2026-86950.
Available research does not establish that the newly patched CoreGraphics vulnerability was used by FomoPeek.
Binance previously advised users who had installed affected FomoPeek versions to remove the application, update iOS and move self-custodied cryptocurrency to a new wallet created on a clean device if sensitive wallet information may have been exposed.
Darksword Raises Another iOS Wallet Security Concern
SlowMist has also tracked Darksword, an advanced iOS exploit framework that researchers say can compromise devices after victims open malicious links.
The security firm has warned that Darksword may have been adapted to target cryptocurrency wallets on iOS 26.5, although Apple and Google have not independently confirmed that reported capability.
The framework combines multiple vulnerabilities to bypass iOS protections and deploy additional payloads.
Once attackers gain elevated access, they could potentially collect messages, browser history, account information, location data and information associated with cryptocurrency wallets.
SlowMist CISO 23pds has warned that locally stored private keys could be among the data exposed when attackers gain sufficiently high access to an iOS device.
There is currently no public evidence establishing that CVE-2026-86950 is part of Darksword.
FomoPeek, Darksword and Apple's newly disclosed CoreGraphics flaw should therefore be treated as separate security findings unless further technical evidence establishes a connection.
Apple Has Not Confirmed Any Crypto Theft From The New Flaw
Apple's disclosure confirms that CVE-2026-86950 can potentially lead to arbitrary code execution and that the company received a report of possible exploitation against specific targets.
It does not mention cryptocurrency, digital wallets, seed phrases or private keys.
Apple has also not disclosed any cryptocurrency losses, victims or financial damage linked to the vulnerability.
SlowMist's warning adds context based on its wider research into iOS attacks affecting crypto users, but does not establish that CVE-2026-86950 itself was responsible for any wallet theft.
The distinction is important because the existence of active exploitation does not by itself prove that cryptocurrency users have already lost funds through this particular vulnerability.
Which Apple Devices Need The Update?
iOS 26.7.1 is available for iPhone 11 and newer models, while iPadOS 26.7.1 covers supported iPad Pro, iPad Air, iPad and iPad mini models.
Apple also fixed the same CoreGraphics vulnerability in macOS Sequoia 15.8.1, while macOS Tahoe 26.7.1 received the corresponding correction.
Users running the iOS 26 branch can install the update through Settings, General and Software Update.
For crypto users who may already have exposed wallet credentials, updating the operating system does not undo an earlier compromise.
If a seed phrase or private key was potentially accessed during a previous incident, creating a fresh wallet on an uncompromised device and moving funds is a separate security measure.
Apple has not yet released further details about the targeted attacks involving CVE-2026-86950, leaving the exact exploitation method and scope of the reported activity undisclosed.
XingChi
