cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads

· Original article ↗

Summary

Apple backported a fix for CVE-2026-86950, a CoreGraphics flaw it says may have been exploited in targeted attacks, to iOS 18.7.11 and iPadOS 18.7.11. The updates also fix other security issues.

Key points

  • CVE-2026-86950 is an out-of-bounds write in CoreGraphics that could enable arbitrary code execution when processing a maliciously crafted file.
  • Apple said the flaw may have been exploited in sophisticated attacks against specific individuals using versions of iOS before iOS 27; the article provides no independent confirmation.
  • Apple extended the fix to iOS 18.7.11 and iPadOS 18.7.11 for supported older iPhones and iPads.
  • Those updates also address CVE-2026-65339, which could allow an app to leak sensitive information, and CVE-2026-86990, which could let a malicious app access the camera without permission.
  • Apple also released version 27.2 updates for its operating systems and Safari, fixing hundreds of vulnerabilities, including CVE-2026-86987 in Apple Intelligence.

Article Details

Vulnerability Types
  • Out-of-bounds write
  • Logic issue
  • Access vulnerability
  • Authorization issue
Severity
High (CVSS 8.8)
Affected Versions
  • iOS versions before iOS 27
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1203 · Exploitation for Client ExecutionCVE-2026-86950 is an out-of-bounds write in CoreGraphics that can enable arbitrary code execution when processing a maliciously crafted file.

CVE

CVE-2026-65339iOS 18.7.11 and iPadOS 18.7.11 also address a logic issue in Audio (CVE-2026-65339) that could be exploited by an app to leak sensitive user information and an access vulnerability in CoreMedia (CVE-2026-86990) thatCVE-2026-86950The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file.CVE-2026-86987Notable among the defects is an authorization issue in Apple Intelligence (CVE-2026-86987) that could be exploited by a remote attacker to access sensitive user data. The iPhone maker said the issue was addressed in iOSCVE-2026-86990be exploited by an app to leak sensitive user information and an access vulnerability in CoreMedia (CVE-2026-86990) that could be abused by a malicious app to access the camera without user permission.

Vendors

AppleApple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices.

Products

Apple IntelligenceNotable among the defects is an authorization issue in Apple Intelligence (CVE-2026-86987) that could be exploited by a remote attacker to access sensitive user data. The iPhone maker said the issue was addressed in iOSCore GraphicsThe vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file.CoreMediathat could be exploited by an app to leak sensitive user information and an access vulnerability in CoreMedia (CVE-2026-86990) that could be abused by a malicious app to access the camera without user permission.iOSPatches for the flaw were released last month by Apple in versions iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, acknowledging that it may have been exploited in sophisticated attacks againstiPadOSPatches for the flaw were released last month by Apple in versions iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, acknowledging that it may have been exploited in sophisticated attacks against

Related Articles