macOS Tahoe 26.7.1
Emergency Fix for an Exploited CoreGraphics Flaw — Superseded by 26.7.2
What's in macOS Tahoe 26.7.1
Apple released macOS Tahoe 26.7.1 (build 25G241) on September 28, 2026, two weeks after Tahoe 26.7. It fixes one vulnerability: CVE-2026-86950, an out-of-bounds write in CoreGraphics that could let a maliciously crafted file execute arbitrary code. Apple's advisory says the flaw “may have been exploited in a highly targeted attack” against iPhones running versions before iOS 27. The bug was reported by Meta's product security team.
Because the exploit was seen in the wild, this was an install-now update for every Intel Mac and every Apple Silicon Mac still on Tahoe. macOS Sequoia 15.8.1 (build 24H32) shipped the same day with the same fix, and macOS 27.0.1 arrived for Golden Gate users, although macOS 27.0 already contained the CoreGraphics patch.
Superseded by Tahoe 26.7.2
On October 26, 2026, Apple released macOS Tahoe 26.7.2 (build 25G332), a broader security update that includes this fix. If Software Update offers 26.7.2, install that.
How to Install
Open System Settings → General → Software Update and click Update Now next to the Tahoe entry. On an Apple Silicon Mac, ignore the larger Upgrade Now button unless you intend to move to macOS 27. The update is small and needs one restart.