Apple backports CoreGraphics zero-day patches to older iPhones and iPads

Apple has extended patches for a CoreGraphics zero-day vulnerability to older iPhones and iPads. The company said the flaw may have been exploited in an “extremely sophisticated” attack targeting specific people using iOS versions before iOS 27.

Tracked as CVE-2026-86950, the out-of-bounds write flaw was discovered by Meta Product Security. Apple said processing a maliciously crafted file could allow arbitrary code execution. The company addressed the issue with improved bounds checking.

Apple first patched the vulnerability in September for devices running iOS 26.7.1 and iPadOS 26.7.1, as well as macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. This week’s backported patches cover iPhone XS, iPhone XS Max and iPhone XR; iPad 7th generation; iPad Air 4th generation and later; iPad 9th generation and later; and iPad mini 6th generation and later.

Apple said the vulnerability was used in highly targeted attacks. The company has now fixed two zero-days exploited in attacks this year. The other, CVE-2026-20700, was a dyld code-execution flaw patched in February.