Apple patches actively exploited CoreGraphics zero day flaw on older devices
Apple has backported a security patch for an actively exploited CoreGraphics vulnerability to older iPhone and iPad models that cannot run current operating system updates.
FTMQ Security, written by our newsroom3 views
Apple released security updates to fix a zero-day vulnerability in CoreGraphics for older iPhone and iPad models. Bitdefender and The Hacker News both report that the vulnerability, tracked as CVE-2026-86950, has been exploited in real-world attacks. The flaw affects older devices that cannot run the latest versions of iOS, Bitdefender reported. [1][4]
The vulnerability is an out-of-bounds write flaw in CoreGraphics that carries a CVSS score of 8.8, according to The Hacker News. Processing crafted image files can lead to arbitrary code execution on vulnerable devices. Apple warned earlier that the flaw was used in highly sophisticated targeted attacks against specific individuals, Bitdefender reported. [1][4]
Apple originally patched CVE-2026-86950 in late September for newer devices running iOS 26, iPadOS 26, and supported versions of macOS, Bitdefender reported. The latest updates, which were released on October 26, extend these security fixes to legacy devices, according to Bitdefender. [1]
Security administrators and end users operating older Apple devices should install the latest software updates immediately to mitigate the risk of arbitrary code execution. [1][4]
In short
- Apple backported a fix for the zero-day flaw CVE-2026-86950 to older iPhone and iPad models.
- The vulnerability is an out-of-bounds write in CoreGraphics that can allow arbitrary code execution.
- CVE-2026-86950 carries a CVSS score of 8.8 and was previously patched on newer operating systems in September.
- Apple noted that the security flaw was exploited in highly targeted real-world cyber attacks.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]Apple patches older iPhones against ‘extremely sophisticated’ attacks leveraging CoreGraphics flawBitdefender, 16h ago (the report this story comes from)
- [2]Apple backports fix for exploited CoreGraphics flaw to older iPhones and iPadsnews.lavx.hu, 1d ago
- [3]Apple backports patch for CoreGraphics zero-day to older iPhonesBetaNews, 1d ago
- [4]Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPadsThe Hacker News, 1d ago
- [5]Apple Backports Exploited CoreGraphics Zero-Day Fix to Older iPhonesSQ Magazine, 1d ago
- [6]Apple Fixes Actively Exploited iOS Zero-Day Vulnerability in CoreGraphicsGBHackers News, 1d ago
- [7]Apple CoreGraphics Zero-Day CVE-2026-86950: Fix Now Backported to Older iPhones and iPadsRescana, 20h ago
- [8]Apple backports CoreGraphics zero-day patches to older iPhonesBleepingComputer, 1d ago
- [9]Apple Released Patches for Exploited CoreGraphics 0-day Vulnerability for Older iPhonesCyberSecurityNews, 1d ago
- [10]Apple patches CoreGraphics flaw exploited on older iPhonesCyberInsider, 1d ago
Background
Our newsroom writes these reports with the help of software, from the 12 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- Apple offers free hardware replacements for defective iPhone 18 Pro Max devicesEnterprise Security, 23d ago
More in Bugs and Patches
- Brotli decoder memory corruption flaw affects multiple runtimes and software packages3d ago
- Researchers publish proof of concept exploit for Node js Brotli vulnerability4d ago
- Microsoft releases record October 2026 update containing 1413 vulnerabilities4d ago
- Microsoft releases patch for actively exploited Windows Shell zero day vulnerability4d ago
- PHP Foundation issues urgent patches for decade old remote code execution flaws4d ago
- Indian CA eMudhra suffers private key compromise in intermediate certificates5d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.