cyber.hendryadrian.com
Vulnerability & Exploit · malwarebytes.com

Apple Backports Fix for Potentially Exploited CoreGraphics Flaw to Older iPhones and iPads

· Original article ↗

Summary

Apple released updates fixing CVE-2026-86950, an out-of-bounds write in CoreGraphics that may have been exploited in targeted attacks. The fix is available for older devices, including through iOS 18.7.11 and iPadOS 18.7.11.

Key points

  • CVE-2026-86950 is an out-of-bounds write in Apple’s CoreGraphics framework; processing a maliciously crafted file may allow arbitrary code execution.
  • Apple says it is aware of a report that the flaw may have been exploited in sophisticated attacks against specific individuals on iOS versions before iOS 27.
  • Apple first fixed the flaw in iOS 26.7.1 and later backported the fix to iOS 18.7.11 and iPadOS 18.7.11.
  • The iOS 18.7.11 and iPadOS 18.7.11 updates support iPhone XS, XS Max, XR, and seventh-generation iPad.
  • The article advises users to install available updates; it also recommends restarting and considering Lockdown Mode for people who may be targeted by sophisticated spyware.

Article Details

Vulnerability Types
  • Out-of-bounds write
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Consider enabling Apple’s Lockdown Mode.

MITRE ATT&CK

T1203 · Exploitation for Client ExecutionProcessing a maliciously crafted file in CoreGraphics may lead to arbitrary code execution.

CVE

CVE-2026-86950The headline bug is CVE-2026-86950, in CoreGraphics, Apple’s framework for drawing graphics, images and PDF content. It’s an out-of-bounds write flaw, where software writes data outside the memory set aside for it. The

Vendors

AppleApple’s latest updates include a fix for a CoreGraphics bug that may have been exploited in targeted attacks. The fix is now available for older iPhones and iPads.

Products

Core GraphicsApple’s latest updates include a fix for a CoreGraphics bug that may have been exploited in targeted attacks. The fix is now available for older iPhones and iPads.iOSApple released security updates on October 26. Apple first fixed the flaw in iOS 26.7.1. Its latest updates also bring the fix to older devices that can’t run iOS 26, including the iPhone XS, iPhone XS Max, iPhone XR,iPadOSiOS 27.2 and iPadOS 27.2 iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th

Related Articles