Apple backports CoreGraphics zero-day patches to older iPhones
CVE-2026-86950, an out-of-bounds write, may have been used in targeted attacks on iOS before iOS 27.
Apple backported last month’s fix for CVE-2026-86950, an out-of-bounds write in CoreGraphics found by Meta Product Security, to older iPhones and iPads. Processing a maliciously crafted file may lead to arbitrary code execution. Apple said it is aware of a report that the bug may have been exploited in extremely sophisticated attacks against specific people on iOS versions before iOS 27. September patches covered iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. This week’s updates extend coverage to listed older iPhone and iPad models.
Unconfirmed: Apple says the flaw may have been exploited and cites a report, without detailing victims or scale.
- Improved bounds checking addresses the out-of-bounds write.
- September fixes included iOS 26.7.1 and iPadOS 26.7.1.
- macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 were also patched then.
- Backports cover iPhone XS, XS Max, XR, and named older iPads.
- Apple says this is the second exploited zero-day it fixed this year.
Impact: Arbitrary code execution via a maliciously crafted file
| Product | Affected | Fixed in |
|---|---|---|
| Apple CoreGraphics | iOS before iOS 27; older iPhone and iPad models now receiving backports | iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1, plus this week’s backports |
- 1.Install the backported updates on listed older iPhones and iPads.
- 2.Install the September updates on devices still running earlier current OS branches.
- CVEs
- CVE-2026-86950
- Vendors
- Apple
- Products
- CoreGraphicsiOSiPadOSmacOS
- Organizations
- Meta Product Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86950 | Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS | 8.8 | 26% | KEVPoC ×3 | KEV |
From the original article
2 min read at bleepingcomputer.com
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.