GoKawiilApple extends CoreGraphics zero-day fix to older iPhones and iPads
Apple has backported a security patch for CVE-2026-86950, a CoreGraphics out-of-bounds write flaw, to older devices including the iPhone XS, XR, and several iPad models. The vulnerability, originally patched last month for newer iOS, iPadOS and macOS versions, was discovered by Meta Product Security and has reportedly been exploited in a highly targeted attack against specific individuals on iOS versions before iOS 27.
GoKawiil's interpretation of the reporting above, not reported fact.
Extending patches to older hardware suggests Apple judged the flaw serious enough to protect devices outside its usual update cycle, even though it describes exploitation as limited to sophisticated, targeted attacks. The bug is the second zero-day Apple has fixed this year after a dyld flaw patched in February, pointing to a pattern of advanced actors probing core Apple frameworks for espionage-style intrusions.
- CVE-2026-86950 is an out-of-bounds write bug in Apple's CoreGraphics framework, found by Meta Product Security.
- Apple has now backported the fix to iPhone XS/XS Max/XR and several iPad models after patching newer OS versions last month.
- It is the second zero-day Apple has patched in 2026, following a dyld vulnerability fixed in February, both used in targeted attacks.
Source: bleepingcomputer.com, 2026-10-27
Published there as: “Apple backports CoreGraphics zero-day patches to older iPhones”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.