Apple has released security updates for older iPhones and iPads to address a zero-day vulnerability in CoreGraphics that was exploited in a “very sophisticated” targeted attack. The company originally patched the flaw last month in newer versions of iOS, iPadOS and macOS, but has now backported the fix to additional devices.
Apple patches exploited CoreGraphics zero-day
Meta Product Security discovered the vulnerability, which is tracked as CVE-2026-86950. The flaw is an CWE-787 out-of-bounds write in CoreGraphics, Apple’s framework for 2D vector graphics, text drawing and image rendering across iOS, macOS, iPadOS, watchOS and tvOS.
An attacker could exploit the issue by writing data outside an allocated memory buffer. A successful attack could crash an application, corrupt data or enable arbitrary code execution.
“Apple is aware of reports that this issue may have been exploited in highly sophisticated attacks against specific targeted individuals on versions of iOS prior to iOS 27,” Apple warned on Monday.
According to Apple, “processing a maliciously crafted file may lead to arbitrary code execution. Improved bounds checking addresses an out-of-bounds write issue.”
Older iPhones and iPads receive the fix
Apple previously addressed CVE-2026-86950 in September with iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
This week’s backported security updates extend protection to the iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
Although Apple said the vulnerability has been used only in highly targeted attacks, users with compatible devices should install the updates to reduce the risk of potential exploitation.
Apple has fixed two exploited zero-days this year
CVE-2026-86950 is the second zero-day Apple has patched this year after confirming that it was exploited in attacks. The other, CVE-2026-20700, was an arbitrary code execution vulnerability in dyld, the dynamic linker used by Apple operating systems. Apple described that flaw as being exploited in a “very sophisticated” targeted attack and patched it in February.
Earlier this year, Apple also fixed a high-severity vulnerability in Beats Studio Buds, tracked as CVE-2025-20701, which could allow attackers within Bluetooth range to eavesdrop on users’ conversations. The company also released updates for older iPhones and iPads to address four vulnerabilities targeted in cyberespionage and cryptocurrency theft attacks involving the Coruna exploit kit.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com