iPad (Product): news timeline & CVEs

Update your iPhone, iPad, or Mac: Flaw could run attackers’ code

Apple patched CVE-2026-86950, a CoreGraphics flaw possibly exploited in targeted iPhone attacks via malicious files.

Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that can let an attacker run code when a device processes a maliciously crafted file. Apple says it is aware of a report that the flaw may have been exploited in an extremely sophisticated, highly targeted attack against specific iPhone users on iOS versions before iOS 27. Fixes are in iOS and iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1, addressed with improved bounds checking.

Malwarebytes Labsupdated 14:30 UTC · 7h agofirst 10:35 UTC · 11h agoExploit / PoC in the wild 15 sources CVE-2026-86950

EX-ARRR: Sailing the 0-click Seas

Researcher reports a zero-click heap overflow in Apple's OpenEXR decoder, triggered when iMessage parses an image.

A researcher published a write-up of a zero-click heap overflow in Apple's OpenEXR decoder, libAppleEXR, which ImageIO uses to parse EXR images. The destination buffer is sized for RGB while the interleave path writes an extra alpha channel, so mostly attacker-controlled pixel data spills into adjacent heap memory. The author says an iMessage carrying the image is decoded immediately by a privileged daemon, with no tap, and that they reproduced the overflow on a real iPad. The excerpt does not name a CVE, affected versions, or a patch.

Lobsters · securitySep 27, 23:32 UTC · 1d agoExploit / PoC4· 3 reads

iPad

Timeline2 articles

Related CVEsby mentions

Appears with

Update your iPhone, iPad, or Mac: Flaw could run attackers’ code

EX-ARRR: Sailing the 0-click Seas