Apple extends CoreGraphics zero-day fix to older iPhones and iPads
Owners of the iPhone XS, XS Max, XR and several iPad models should install the backported update, which Apple says blocks a flaw possibly used in targeted attacks.
Apple has extended fixes for CVE-2026-86950, a CoreGraphics out-of-bounds write flaw, to older iPhones and iPads after first patching it in September for iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. The bug, found by Meta Product Security, could let a maliciously crafted file crash a program, corrupt data or run arbitrary code. Apple says it may have been used in a highly sophisticated attack against specific individuals on iOS versions before iOS 27. The backported patches now reach the iPhone XS, XS Max and XR, along with several older iPad models, and Apple strongly recommends installing them. This is the second zero-day Apple has fixed this year, following the dyld flaw CVE-2026-20700 patched in February.
Why it matters
Owners of older iPhones and iPads that Apple no longer ships current updates for are now covered against a flaw Apple says may have been exploited against specific individuals. The fix arrives as the second zero-day Apple has patched this year, so the gap between newer and older devices matters for anyone who has not yet updated. Users of those older models who have not yet installed the backported patches remain exposed to a maliciously crafted file that could run arbitrary code.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.