Apple backports CoreGraphics zero-day patches to older iPhones
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in extremely sophisticated targeted attacks on iOS devices.
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices.
While Apple said CVE-2026-86950 is exploited only in highly targeted attacks, it is strongly advised to install these backported patches to block potential attacks.
Earlier this year, Apple also fixed a high-severity Beats Studio Buds flaw (CVE-2025-20701) that lets attackers in Bluetooth range spy on users' conversations, and patched older iPhones and iPads against four vulnerabilities targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit.
The other (CVE-2026-20700), an arbitrary code execution vulnerability in dyld (the Dynamic Link Editor used by Apple operating systems) also exploited in "extremely sophisticated" targeted attacks, was patched in February .
Meta Product Security discovered this out-of-bounds write weakness (tracked as CVE-2026-86950 ) in CoreGraphics, a framework used for two-dimensional vector graphics, text drawing, and image rendering across iOS, macOS, iPadOS, watchOS, and tvOS.
Apple patched the same vulnerability in September for devices running iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
Successful exploitation of out-of-bounds write security issues can let attackers crash programs, corrupt data, or gain remote code execution by writing data outside the allocated memory buffer.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
An out-of-bounds write issue was addressed with improved bounds checking." With this week's security patches, Apple has now also addressed this vulnerability on iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
With this vulnerability, Apple has fixed two zero-days exploited in attacks this year; arista patches new VeloCloud Orchestrator zero-day exploited in attacks
What happened
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices.
While Apple said CVE-2026-86950 is exploited only in highly targeted attacks, it is strongly advised to install these backported patches to block potential attacks.
What changed
Earlier this year, Apple also fixed a high-severity Beats Studio Buds flaw (CVE-2025-20701) that lets attackers in Bluetooth range spy on users' conversations, and patched older iPhones and iPads against four vulnerabilities targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit.
The other (CVE-2026-20700), an arbitrary code execution vulnerability in dyld (the Dynamic Link Editor used by Apple operating systems) also exploited in "extremely sophisticated" targeted attacks, was patched in February .
Who is affected
Meta Product Security discovered this out-of-bounds write weakness (tracked as CVE-2026-86950 ) in CoreGraphics, a framework used for two-dimensional vector graphics, text drawing, and image rendering across iOS, macOS, iPadOS, watchOS, and tvOS.
Apple patched the same vulnerability in September for devices running iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
Why it matters
Successful exploitation of out-of-bounds write security issues can let attackers crash programs, corrupt data, or gain remote code execution by writing data outside the allocated memory buffer.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Technical details
An out-of-bounds write issue was addressed with improved bounds checking." With this week's security patches, Apple has now also addressed this vulnerability on iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
With this vulnerability, Apple has fixed two zero-days exploited in attacks this year; arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Attribution
BleepingComputer: Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.