Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices.
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices.
Patches for the flaw were released last month by Apple in versions iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, acknowledging that it may have been exploited in sophisticated attacks against specific individuals using devices running iOS before iOS 27.
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices.
Earlier this year, Apple also fixed a high-severity Beats Studio Buds flaw (CVE-2025-20701) that lets attackers in Bluetooth range spy on users' conversations, and patched older iPhones and iPads against four vulnerabilities targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit.
Notable among the defects is an authorization issue in Apple Intelligence (CVE-2026-86987) that could be exploited by a remote attacker to access sensitive user data.
Although Apple makes no mention of any of these flaws being exploited in the wild, it's always a good practice to update the devices to the latest version for optimal protection.
The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file.
iOS 18.7.11 and iPadOS 18.7.11 also address a logic issue in Audio (CVE-2026-65339) that could be exploited by an app to leak sensitive user information and an access vulnerability in CoreMedia (CVE-2026-86990) that could be abused by a malicious app to access the camera without user permission.
While Apple said CVE-2026-86950 is exploited only in highly targeted attacks, it is strongly advised to install these backported patches to block potential attacks.
The other (CVE-2026-20700), an arbitrary code execution vulnerability in dyld (the Dynamic Link Editor used by Apple operating systems) also exploited in "extremely sophisticated" targeted attacks, was patched in February .
What happened
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices.
Patches for the flaw were released last month by Apple in versions iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, acknowledging that it may have been exploited in sophisticated attacks against specific individuals using devices running iOS before iOS 27.
What changed
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices.
Earlier this year, Apple also fixed a high-severity Beats Studio Buds flaw (CVE-2025-20701) that lets attackers in Bluetooth range spy on users' conversations, and patched older iPhones and iPads against four vulnerabilities targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit.
Who is affected
Notable among the defects is an authorization issue in Apple Intelligence (CVE-2026-86987) that could be exploited by a remote attacker to access sensitive user data.
Although Apple makes no mention of any of these flaws being exploited in the wild, it's always a good practice to update the devices to the latest version for optimal protection.
Why it matters
The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file.
iOS 18.7.11 and iPadOS 18.7.11 also address a logic issue in Audio (CVE-2026-65339) that could be exploited by an app to leak sensitive user information and an access vulnerability in CoreMedia (CVE-2026-86990) that could be abused by a malicious app to access the camera without user permission.
Technical details
While Apple said CVE-2026-86950 is exploited only in highly targeted attacks, it is strongly advised to install these backported patches to block potential attacks.
The other (CVE-2026-20700), an arbitrary code execution vulnerability in dyld (the Dynamic Link Editor used by Apple operating systems) also exploited in "extremely sophisticated" targeted attacks, was patched in February .
The release comes as Apple shipped iOS 27.2, iPadOS 27.2 , macOS Golden Gate 27.2 , tvOS 27.2 , watchOS 27.2 , visionOS 27.2 , and Safari 27.2 , fixing hundreds of vulnerabilities, including many in AppleAVD, CoreAudio, ImageIO, kernel, Model I/O, Screen Sharing Server, Spotlight, StorageKit, and WebKit.
Response
With this vulnerability, Apple has fixed two zero-days exploited in attacks this year.
Apple patched the same vulnerability in September for devices running iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
What security teams should do
An out-of-bounds write issue was addressed with improved bounds checking." With this week's security patches, Apple has now also addressed this vulnerability on iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Attribution
The Hacker News: Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices.
BleepingComputer: Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.