Overview
Apple has backported the fix for CVE-2026-86950, an actively exploited CoreGraphics zero-day, to older iPhones and iPads. The same release wave, iOS and macOS 27.2, patches 286 vulnerabilities in total according to SecurityWeek's count.
The flaw is an out-of-bounds write in CoreGraphics, the framework behind 2D vector graphics, text drawing, and image rendering. Apple says processing a maliciously crafted file may lead to arbitrary code execution, and that it may have been exploited in an "extremely sophisticated attack" against specific targeted individuals. Meta's Product Security team discovered it.
Timeline and Patched Versions
- Late September 2026: Apple first fixed the bug in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
- This week: The fix is backported to iOS and iPadOS 18.7.11, covering devices that cannot run newer releases, including iPhone XS, XS Max, XR, and several older iPad generations.
- iOS and macOS 27 are not affected by the exploited issue.
This is the second zero-day Apple has fixed this year; the other, CVE-2026-20700 in dyld, was patched in February.
The Wider 27.2 Release Wave
| Release | Vulnerabilities fixed |
|---|---|
| macOS Golden Gate 27.2 | 263 |
| macOS Tahoe 26.7.2 | 213 |
| macOS Sequoia 15.8.2 | 197 |
| iOS and iPadOS 27.2 | 163 |
| iOS and iPadOS 26.7.2 | 134 |
| visionOS 27.2 | 125 |
| tvOS 27.2 | 72 |
| watchOS 27.2 | 62 |
| Safari 27.2 | 33 |
| iOS and iPadOS 18.7.11 | 3 (including the exploited flaw) |
Roughly 140 of the flaws are shared between iOS and macOS. Notable fixes include:
- iOS and iPadOS: memory corruption in WebKit, the kernel, and image, font, PDF, and audio/video components, some enabling code execution; WebContent sandbox escapes; privacy bypasses; a Kerberos KDC impersonation issue; and a bug letting a nearby attacker access a Thread network.
- macOS: more than a dozen privilege escalation flaws that could give apps root, sandbox escapes, Gatekeeper bypasses, kernel memory corruption in file system and disk image components, and Screen Sharing, Remote Management, and SMB flaws, including a Remote Management bug that could allow remote code execution.
Recommended Actions
- Update iPhones and iPads to the newest release available for the device, iOS 18.7.11 at minimum on older hardware.
- Update Macs to 27.2, 26.7.2, or 15.8.2 depending on the installed major version.
- Enable Lockdown Mode for users likely to be targeted, such as journalists, executives, and activists.
- Use MDM to enforce minimum OS versions and report devices that remain behind.