Apple backports security fixes for a high-severity CoreGraphics flaw that has been exploited in real-world attacks to older iPhones and iPads. The vulnerability, identified as CVE-2026-86950, involves an out-of-bounds write in CoreGraphics that can allow arbitrary code execution when processing a maliciously crafted file.
Across coverage, Apple also issues broader platform updates alongside the backported patch. MacRumors and SecurityWeek report that Apple’s wider iOS and macOS updates include many additional security fixes, with MacRumors listing specific releases for iOS, iPadOS, macOS, and tvOS. Apple’s messaging in the reporting emphasizes the risk is tied to targeted, “extremely sophisticated” attacks on versions of iOS before iOS 27, and that the company is aware of a report of exploitation.
While outlets largely agree on the affected flaw and the backporting to older devices, they differ in emphasis: Hacker News focuses on the nature and severity of the vulnerability, while Bleeping Computer highlights the “zero-day” framing of the exploited bug and the targeted-attack description.
