CISA gives federal agencies until October 2 to patch Apple's exploited CoreGraphics flaw

CoreGraphics handles graphics and rendering across Apple's operating systems, including images and PDFs ^[8]. The fix is a bounds check. Apple's advisory gives it one line: "An out-of-bounds write issue was addressed with improved bounds checking" ^[13].

The CVSS score is 8.8 ^[2]. The exploitation report matters more. "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27," Apple's advisory reads ^[6]. Taken at its word, the advisory describes an exploit aimed at a selected group of people on one platform ^[6]. Apple has not said who they were, how many were hit, whether the attacks succeeded, when exploitation began or how the files were delivered ^[7].

Security Affairs lists a web page, an email attachment or a messaging app as ways to get a crafted file in front of the parser. It also notes that Apple has confirmed none of those routes for this CVE ^[14]. The same report points out that Meta has previously identified attacks that used Apple vulnerabilities against users of its messaging platforms ^[12]. Meta's team found this bug ^[9]. I'd look at messaging apps first as the likely delivery channel. That is an inference from Meta's past findings, and Apple has not confirmed it ^[12].