Apple brings CoreGraphics security fix to older iPhones and iPads

BleepingComputer identifies the flaw as CVE-2026-86950, an out-of-bounds write in CoreGraphics discovered by Meta Product Security. It reports that Apple patched the same vulnerability in September for iOS and iPadOS 26.7.1 and listed macOS releases. In Apple’s security description quoted by BleepingComputer, processing a maliciously crafted file may lead to arbitrary code execution; improved bounds checking addressed the flaw.

Both BleepingComputer and MacRumors quote Apple as saying it is aware of a report that the issue “may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” BleepingComputer recommends installing the backported patches to block potential attacks.