Apple brings CoreGraphics zero-day fix to older iPhones and iPads

Apple has backported last month's security fixes to older iPhone and iPad models. The patches close a zero-day vulnerability that attackers used in "extremely sophisticated" targeted attacks on iOS devices.

In September, the company had already fixed the flaw in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Devices that cannot run the current releases are now protected as well.

The vulnerability

The bug, tracked as CVE-2026-86950, was discovered by Meta Product Security. It is an out-of-bounds write in CoreGraphics, the framework that handles two-dimensional vector graphics, text drawing and image rendering across iOS, macOS, iPadOS, watchOS and tvOS.

Flaws of this kind can let attackers crash programs, corrupt data or achieve remote code execution. They do this by writing data outside the allocated memory buffer.

On Monday, Apple said it was aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific individuals running versions of iOS before iOS 27. According to the company, processing a maliciously crafted file may lead to arbitrary code execution. The bug was fixed with improved bounds checking.

Devices covered

The new updates cover the iPhone XS, iPhone XS Max and iPhone XR. Among tablets, they reach the iPad 7^th generation, iPad Air 4^th generation and later, iPad 9^th generation and later, and iPad mini 6^th generation and later.

Apple stresses that CVE-2026-86950 was exploited only in highly targeted attacks. Even so, owners of the listed devices are strongly advised to install the updates.

Not the first this year

This is the second zero-day Apple has fixed this year. The first, CVE-2026-20700, was found in dyld, the dynamic link editor used by Apple's operating systems. It allowed arbitrary code execution, was likewise exploited in "extremely sophisticated" targeted attacks, and was patched in February.

Earlier this year, the company also fixed a high-severity flaw in Beats Studio Buds (CVE-2025-20701). It allowed an attacker within Bluetooth range to eavesdrop on users' conversations. Apple also issued fixes for older iPhones and iPads against four vulnerabilities exploited in cyberespionage and crypto-theft campaigns using the Coruna exploit kit.

Source: Bleeping Computer