Apple fixes CoreGraphics flaw CVE-2026-86950 on older iPhones and iPads
Apple says the out-of-bounds write may have been used in targeted attacks on iOS before iOS 27; iOS 18.7.11 backports the fix.
72
Product
iPadOS
- Mentions · 7d13
- Mentions · 30d19
- All mentions36
- First seenSep 8, 2026
- Last mentioned1d ago
Timeline
36 articles · newest firstApple advisory AV26-1099 lists flaws in iOS, macOS, Safari and more
Affected builds are those before the stated iOS, iPadOS, macOS, visionOS, tvOS, watchOS and Safari releases.
48
Apple backports fix for exploited CoreGraphics flaw to older iPhones and iPads
iOS 18.7.11 and iPadOS 18.7.11 also fix an Audio data leak and unauthorized camera access.
76
Apple patches 286 iOS and macOS bugs, backports exploited flaw
iOS and iPadOS 18.7.11 carry the CVE-2026-86950 fix; Apple says iOS and macOS 27 are not affected.
76
Apple fixes exploited CoreGraphics zero-day in iOS 18.7.11
CVE-2026-86950 is an out-of-bounds write triggered by a crafted file; two other flaws can leak data or open the camera.
82
Apple backports CoreGraphics zero-day patches to older iPhones
CVE-2026-86950, an out-of-bounds write, may have been used in targeted attacks on iOS before iOS 27.
76
Apple patches exploited CoreGraphics zero-day on older iPhones and iPads
iOS and iPadOS 18.7.11 fix CVE-2026-86950, an out-of-bounds write Apple says may have hit specific targets.
78
Apple issues iOS 18.7.11 and iPadOS 18.7.11 security update
The notice names the Audio component and lists older iPhone and iPad models that receive the update.
32
Apple issues iOS 26.7.2 and iPadOS 26.7.2 security update
The notice names the Accelerate Framework and starts the device list at iPhone 11 and later.
32
Apple issues iOS 27.2 and iPadOS 27.2 security update
The notice names the Accelerate Framework for iPhone 11 and later and newer iPad Pro models.
32
Apple October 2026 updates patch 304 flaws, including prior exploit
Already exploited CoreGraphics flaw CVE-2026-86950 now gets iOS 18 fixes; no newly exploited bug is flagged.
76
Apple publishes iPadOS 26.7.2 (23H128)
Build 23H128 is listed without any stated vulnerabilities, fixes, or exploitation.
18
Apple releases iPadOS 27.2 (24B119)
The listing only points to downloads and release notes, with no security fixes described.
18
Safari and WebKit block services that turn emails into tracking IDs
The blocks ship in iOS 27, iPadOS 27, macOS 27, and visionOS 27 and stop pages from sending addresses to identity-resolution servers.
34
Apple lists iPadOS 27.2 RC build 24B115
The notice only links downloads and release notes and describes no security fixes.
12
iPadOS 27.2 beta 4 (24B5110a)
Apple listed iPadOS 27.2 beta 4, build 24B5110a, with no security details.
18
iPadOS 27.2 beta 3 (24B5099f)
Apple published iPadOS 27.2 beta 3, build 24B5099f, with no security details in the notice.
12
Cybersecurity Newsletter Bulletin – Pentagon Data Breach, Citrix, Fortimail and Apple 0-days and 20+ stories
Pentagon breach exposed about 3 million personnel records while Apple, FortiMail, and Citrix zero-days were exploited.
90
Public PoC Released for Apple CoreGraphics Zero-Day CVE-2026-86950
Public crash PoC released for Apple CoreGraphics zero-day CVE-2026-86950, reportedly used in targeted attacks.
82
Apple Patches CoreGraphics Zero Day Exploited in Attacks
Apple patched CVE-2026-86950, a CoreGraphics zero-day reportedly exploited against targeted iOS users.
84
U.S. CISA adds Apple Multiple Products flaw to its Known Exploited Vulnerabilities catalog
CISA adds exploited Apple CoreGraphics zero-day CVE-2026-86950 to the Known Exploited Vulnerabilities catalog.
84
Apple Warns Users iOS Vulnerability Exploited in Attack (CVE-2026-86950)
Apple patched CVE-2026-86950, an out-of-bounds write in iOS and macOS exploited in targeted attacks.
86
Still running iOS 26? Update your iPhones, iPads and Macs for this urgent security fix
Apple patched graphics-engine CVE-2026-86950 in iOS 26 after possible targeted exploitation.
82
Apple security advisory (AV26-971)
Apple says CVE-2026-86950 may have been exploited across its OS lineup, and CISA added it to KEV.
80
Update your iPhone, iPad, or Mac: Flaw could run attackers’ code
Apple patched CVE-2026-86950, a CoreGraphics flaw possibly exploited in targeted iPhone attacks via malicious files.
85
Apple squashes zero-day bug exploited in “extremely sophisticated” attack (CVE-2026-86950)
Apple fixed actively exploited Core Graphics zero-day CVE-2026-86950 that enables code execution from a malicious file.
86
Apple patches CoreGraphics zero-day flaw exploited in attacks
Apple patched CoreGraphics zero-day CVE-2026-20700 after sophisticated targeted attacks on iOS devices.
86
APPLE-SA-09-28-2026-1 iOS 26.7.1 and iPadOS 26.7.1
Apple patched a CoreGraphics flaw in iOS 26.7.1 and iPadOS 26.7.1 that may allow code execution via a crafted file.
48
Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks
Apple patched CoreGraphics CVE-2026-86950, which may have been exploited in targeted iOS attacks.
83
iPadOS 26.7.1 (23H30)
Apple published iPadOS 26.7.1 (build 23H30) without any listed security details.
20
iPadOS 27.0.1 (24A446)
Apple listed iPadOS 27.0.1 (build 24A446) with no security details in the release notice.
18
iPadOS 27.2 beta 2 (24B5089g)
Apple posted iPadOS 27.2 beta 2, build 24B5089g, without security details.
16
Apple security advisory (AV26-930)
CCCS relays Apple's September 14, 2026 security updates fixing vulnerabilities across iOS 27, macOS Tahoe 26.7, Sequoia 15.8, Safari, and other products.
35
iPadOS 27.2 beta (24B5084k)
Apple released iPadOS 27.2 beta build 24B5084k to developers for testing.
10
iPadOS 26.7 (23H24)
Apple released iPadOS 26.7 (build 23H24) on September 9, 2026; the notice lists downloads without describing security fixes.
15
iPadOS 26.6.2 (23G90)
Apple released iPadOS 26.6.2 (build 23G90), a minor software update listed on its developer releases page without vulnerability details.
18
Related CVEs
by mentions- CVE-2026-8695026%8.8Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS
- Camera access without permission on Apple devices
- CVE-2026-65339<1%5.0A logic issue was addressed with improved checks
- CVE-2026-207002%7.8Exploited Memory Corruption Flaw in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS
- CVE-2025-242004%6.1Incorrect Authorization in Apple iOS/iPadOS Lets Attackers Disable USB Restricted Mode
- Out-of-bounds write in Apple image handling crashes apps
- CVE-2025-2408518%10.0Use-After-Free Privilege Escalation in Apple iOS, iPadOS, macOS and Other Platforms
- CVE-2025-3120021%9.8Memory Corruption in Apple iOS, iPadOS, macOS Audio Processing Enables Code Execution
- Out-of-bounds write in Apple OS via a local app
- Sandbox escape via path handling in macOS
Appears with
- Applevendor · 36
- iOSproduct · 25
- CoreGraphicsproduct · 14
- macOSproduct · 14
- Metaorganization · 10
- Appleorganization · 9
- visionOSproduct · 6
- watchOSproduct · 6
- tvOSproduct · 5
- Safariproduct · 5
- Canadian Centre for Cyber Securityorganization · 3
- macOS Tahoeproduct · 3
- macOS Sequoiaproduct · 3
- Meta Product Securityorganization · 2
- CISAorganization · 2
- WebKitproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.