Cybersecurity
Apple backports CoreGraphics fixes to older iPhones and iPads
Apple said it had backported fixes for a CoreGraphics out-of-bounds write flaw to older iPhones and iPads after warning that the bug had been used in targeted attacks.
- Apple said on Monday that it had backported patches for a CoreGraphics flaw to older iPhones and iPads.
- Meta Product Security found CVE-2026-86950, an out-of-bounds write weakness in CoreGraphics.
- Apple said the flaw may have been used in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27.
- Apple said the updated fixes now covered iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
Apple issued new security updates for older iPhones and iPads to close a CoreGraphics flaw that it had already fixed for newer systems in September. The company had previously patched the issue in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
Meta Product Security found the bug, which Apple tracked as CVE-2026-86950. Apple said it had received a report that the weakness may have been used against specific people on iOS versions before iOS 27.
Apple said a malicious file could lead to arbitrary code execution, and that it fixed the problem with stronger bounds checks. The backport covered iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
Named in this story
Companies
- Apple
- issued the backported patches for older devices
Organisations
- Meta Product Security
- discovered the CoreGraphics flaw
Products and systems
- CoreGraphics
- contained the out-of-bounds write weakness
- iOS
- was the platform on which Apple said the issue had been exploited
- iPadOS
- was one of the platforms Apple patched in September
- iPhone XS
- received the backported fixes
- iPhone XS Max
- received the backported fixes
- iPhone XR
- received the backported fixes
- iPad 7th generation
- received the backported fixes
- iPad Air 4th generation
- received the backported fixes
- iPad 9th generation
- received the backported fixes
- iPad mini 6th generation
- received the backported fixes
How the source tells it
Mostly plain security reporting, with a brief note of urgency from Apple’s warning and a promotional footer appended at the end.
- urgency a vendor warning that the flaw may already have been used, paired with advice to install the patches
- promotion the piece closes with a product-report pitch and a large-sample performance claim