Apple has released security updates for older iPhones and iPads, backporting patches for a CoreGraphics zero-day vulnerability (CVE-2026-86950) that the company says was exploited in highly targeted attacks against specific individuals on versions of iOS before iOS 27.
The out-of-bounds write weakness in CoreGraphics, a framework used for 2D vector graphics, text drawing, and image rendering across Apple operating systems, was initially patched in September for devices running iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. This week's backported patches now extend coverage to older models including iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
Apple warned on Monday that it is aware of reports that this issue "may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." The vulnerability, discovered by Meta Product Security, allows attackers to crash programs, corrupt data, or gain remote code execution by writing data outside the allocated memory buffer. Apple says it addressed the out-of-bounds write issue with improved bounds checking.
While Apple described the exploitation as highly targeted, the company strongly advises users to install these backported patches to block potential attacks. With this update, Apple has now fixed two zero-days exploited in attacks this year; the other (CVE-2026-20700) was an arbitrary code execution vulnerability in dyld, also exploited in "extremely sophisticated" targeted attacks, patched in February. Earlier this year, Apple also fixed a high-severity Beats Studio Buds flaw (CVE-2025-20701) that could let attackers in Bluetooth range spy on users' conversations, and patched older iPhones and iPads against four vulnerabilities targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit.
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.
§
Analysis
Why This Matters
The backported patches extend protection to millions of users on older devices who might otherwise remain vulnerable to a zero-day exploit Apple says was used in extremely sophisticated attacks.
CoreGraphics is a fundamental system framework, so a code execution bug there could give attackers deep access to affected devices.
This marks the second zero-day Apple has fixed this year that was exploited in targeted attacks, underscoring a continued threat landscape for Apple users.
Background
Apple regularly issues security updates for its operating systems. Zero-day vulnerabilities, flaws exploited before the vendor has a patch, are considered critical because there is no defence until a fix is released. Out-of-bounds write flaws in system frameworks like CoreGraphics can lead to arbitrary code execution, making them attractive targets for advanced threat actors. Apple has historically backported patches for older devices when vulnerabilities are actively exploited.
Key Perspectives
Apple: states the vulnerability was addressed with improved bounds checking and warns it may have been exploited in extremely sophisticated attacks against specific targeted individuals.
Meta Product Security: discovered the vulnerability (CVE-2026-86950) and reported it to Apple.
What to Watch
Whether any additional groups or individuals are affected by attacks exploiting this vulnerability before the backported patches were applied.
Whether Apple will release further patches for other older devices still running iOS versions that may be vulnerable.
Potential further discoveries of similar out-of-bounds write flaws in CoreGraphics or other system frameworks.
12 claims in this story checked against 1 source: 9 supported.
Show each claim
SupportedApple backported a CoreGraphics zero-day fix to older iPhones and iPads.BleepingComputer: “Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug”
Partly supportedThe patches address a vulnerability exploited in highly targeted attacks against specific individuals on iOS versions before iOS 27.BleepingComputer: “Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27”
SupportedApple warned on Monday that the issue “may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.”BleepingComputer: “Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27, Apple warned on Monday.”
SupportedThe vulnerability was initially patched in September for iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.BleepingComputer: “Apple patched the same vulnerability in September for devices running iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.”
SupportedThe backported patches cover iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.BleepingComputer: “With this week's security patches, Apple has now also addressed this vulnerability on iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.”
SupportedMeta Product Security discovered the out-of-bounds write vulnerability, tracked as CVE-2026-86950, in CoreGraphics.BleepingComputer: “Meta Product Security discovered this out-of-bounds write weakness (tracked as CVE-2026-86950) in CoreGraphics”
Partly supportedSuccessful exploitation can let attackers crash programs, corrupt data or gain remote code execution by writing data outside the allocated memory buffer.BleepingComputer: “Successful exploitation of out-of-bounds write security issues can let attackers crash programs, corrupt data, or gain remote code execution by writing data outside the allocated memory buffer.”
SupportedApple addressed the out-of-bounds write issue with improved bounds checking.BleepingComputer: “An out-of-bounds write issue was addressed with improved bounds checking.”
Partly supportedApple strongly advises users to install the backported patches to block potential attacks.BleepingComputer: “While Apple said CVE-2026-86950 is exploited only in highly targeted attacks, it is strongly advised to install these backported patches to block potential attacks.”
SupportedApple has fixed two zero-days exploited in attacks this year; the other, CVE-2026-20700, was an arbitrary code execution vulnerability in dyld patched in February.BleepingComputer: “With this vulnerability, Apple has fixed two zero-days exploited in attacks this year. The other (CVE-2026-20700), an arbitrary code execution vulnerability in dyld ... was patched in February.”
SupportedEarlier this year, Apple fixed a high-severity Beats Studio Buds flaw, CVE-2025-20701, that could let attackers in Bluetooth range spy on users' conversations.BleepingComputer: “Earlier this year, Apple also fixed a high-severity Beats Studio Buds flaw (CVE-2025-20701) that lets attackers in Bluetooth range spy on users' conversations”
SupportedApple patched older iPhones and iPads against four vulnerabilities targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit.BleepingComputer: “patched older iPhones and iPads against four vulnerabilities targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit.”