Apple Backports Fix for CoreGraphics Zero-Day Reportedly Exploited in Targeted Attacks
Summary
Apple backported patches for CoreGraphics flaw CVE-2026-86950 to older iPhones and iPads. Apple says it is aware of a report that the vulnerability may have been exploited in highly targeted attacks.
Key points
- CVE-2026-86950 is an out-of-bounds write in CoreGraphics, discovered by Meta Product Security.
- Apple says a maliciously crafted file could lead to arbitrary code execution; the fix uses improved bounds checking.
- Apple is aware of a report that the flaw may have been exploited in highly sophisticated attacks against specific individuals on iOS versions before iOS 27.
- The backported patches cover iPhone XS, XS Max, XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
Article Details
- Vulnerability Types
- Out-of-bounds write
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
Vendors
Products
Core GraphicsApple backports CoreGraphics zero-day patches to older iPhonesiOSApple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices.iPadOSApple patched the same vulnerability in September for devices running iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.