Apple Backports CoreGraphics Zero-Day Patches to Older iPhones and iPads

Apple has backported security updates to older iPhone and iPad models to address a zero-day vulnerability previously patched in newer software versions. The flaw, tracked as CVE-2026-86950, is an out-of-bounds write weakness in the CoreGraphics framework.

Meta Product Security discovered the vulnerability, which affects two-dimensional vector graphics, text drawing, and image rendering processes across Apple operating systems. According to Apple, processing a maliciously crafted file could lead to arbitrary code execution or application crashes due to inadequate bounds checking.

Impact and Targeted Devices

Apple stated it is aware of reports indicating this vulnerability has been exploited in extremely sophisticated, highly targeted attacks against specific individuals using iOS versions prior to iOS 27. The newly released backports extend protection to several legacy and current devices, including:

• iPhone XS, iPhone XS Max, and iPhone XR
• iPad 7th generation and later
• iPad Air 4th generation and later
• iPad mini 6th generation and later

Broader Security Context

This update marks the second zero-day vulnerability addressed by Apple that was actively exploited in attacks this year. In February, Apple patched an arbitrary code execution flaw in the Dynamic Link Editor (dyld) tracked as CVE-2026-20700. Additional fixes earlier in the year included a high-severity flaw in Beats Studio Buds and four vulnerabilities targeted in cyberespionage campaigns.

Practical Implications and Verification

Although Apple noted that the CVE-2026-86950 exploit has been limited to highly targeted attacks, users of supported older hardware are strongly advised to install the latest software updates to mitigate potential risks.

• How to Verify: Users can check and install available updates by navigating to Settings > General > Software Update on their iOS or iPadOS devices.
• Official Guidance: Always rely on official Apple security support documentation for authentic patch advisory details and verification steps.