Apple Extends CoreGraphics Zero-Day Patches to Older iPhone and iPad Models

Apple has extended patches for a zero-day vulnerability to older iPhone and iPad models, closing a security gap that attackers exploited in what the company describes as "extremely sophisticated" targeted campaigns against specific users.

The flaw, designated CVE-2026-86950, resides in CoreGraphics, the framework responsible for rendering two-dimensional vector graphics, text, and images across Apple's ecosystem including iOS, macOS, iPadOS, watchOS, and tvOS. Meta Product Security identified the out-of-bounds write weakness.

Out-of-bounds write vulnerabilities allow attackers to write data beyond allocated memory boundaries, potentially enabling them to crash applications, corrupt data, or execute arbitrary code remotely.

Apple initially patched the vulnerability in September across iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. The company issued a formal warning on Monday, stating: "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27."

The company further noted that "processing a maliciously crafted file may lead to arbitrary code execution. An out-of-bounds write issue was addressed with improved bounds checking."

This week's security updates now cover legacy devices including iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.

Although Apple characterizes CVE-2026-86950 as affecting only highly targeted operations, the company recommends immediate installation of the backported patches to mitigate exploitation risks.

This marks the second zero-day patched by Apple this year following active exploitation. Earlier in February, the company addressed CVE-2026-20700, an arbitrary code execution flaw in dyld (the Dynamic Link Editor used across Apple operating systems), which was similarly weaponized in "extremely sophisticated" targeted attacks.

Apple's security work this year has also included patching a high-severity Beats Studio Buds vulnerability (CVE-2025-20701) that allowed attackers within Bluetooth range to eavesdrop on user conversations, and addressing four vulnerabilities in older iPhones and iPads that were exploited in cyberespionage and cryptocurrency theft campaigns using the Coruna exploit kit.