Apple patches CoreGraphics flaw possibly exploited in targeted attacks

Apple released security updates for older versions of iOS, iPadOS and macOS to fix CVE-2026-86950, an out-of-bounds write in the CoreGraphics component. The flaw could allow arbitrary code execution when processing a maliciously crafted file and may have been exploited in targeted attacks.

• CVE-2026-86950 is an out-of-bounds write in CoreGraphics
• A malicious file could trigger arbitrary code execution
• Apple says the flaw may have been exploited in targeted attacks
• Patches cover older iOS, iPadOS and macOS versions