Apple backports CoreGraphics zero-day patches to older iPhones

Apple has backported fixes for CVE-2026-86950, an out-of-bounds write in CoreGraphics exploited in targeted attacks on iOS versions before iOS 27. The flaw could allow arbitrary code execution when processing a maliciously crafted file. Patches now cover iPhone XS, XS Max, XR, iPad 7th generation and later, iPad Air 4 and later, and iPad mini 6 and later.

• CVE-2026-86950 is an out-of-bounds write in CoreGraphics
• The flaw was exploited in targeted attacks on iOS before 27
• Patches cover iPhone XS/XS Max/XR and iPad 7th gen and later
• Apple first fixed the bug in iOS 26.7.1 in September