BlastDoor (Product): news timeline & CVEs

Still running iOS 26? Update your iPhones, iPads and Macs for this urgent security fix

Apple patched graphics-engine CVE-2026-86950 in iOS 26 after possible targeted exploitation.

Apple patched CVE-2026-86950 in iOS 26, iPadOS 26, and macOS 26 after saying it may have been exploited in extremely sophisticated attacks against specific people. The flaw is in the graphics engine that draws the interface; a successful exploit could expose a broad range of personal data. Apple says roughly four in five iPhones still run iOS 26, while iOS 27, iPadOS 27, and macOS 27 are unaffected. A separate zero-click bug, CVE-2026-86869, fixed with those 27 releases, could be triggered by a malicious iMessage and bypass BlastDoor; use before the fix is not confirmed.

TechCrunch · Securityupdated 14:30 UTC · 7h agofirst 13:25 UTC · 8h agoExploit / PoC in the wild 15 sources CVE-2026-86950 CVE-2026-86869

EX-ARRR: Sailing the 0-click Seas

Researcher reports a zero-click heap overflow in Apple's OpenEXR decoder, triggered when iMessage parses an image.

A researcher published a write-up of a zero-click heap overflow in Apple's OpenEXR decoder, libAppleEXR, which ImageIO uses to parse EXR images. The destination buffer is sized for RGB while the interleave path writes an extra alpha channel, so mostly attacker-controlled pixel data spills into adjacent heap memory. The author says an iMessage carrying the image is decoded immediately by a privileged daemon, with no tap, and that they reproduced the overflow on a real iPad. The excerpt does not name a CVE, affected versions, or a patch.

Lobsters · securitySep 27, 23:32 UTC · 1d agoExploit / PoC4· 3 reads

BlastDoor

Timeline2 articles

Related CVEsby mentions

Appears with

Still running iOS 26? Update your iPhones, iPads and Macs for this urgent security fix

EX-ARRR: Sailing the 0-click Seas