Apple Backports CoreGraphics Zero-Day Patches to Older Devices
Apple has extended security fixes to older iPhone and iPad devices, addressing a zero-day vulnerability previously leveraged in targeted attacks.
Radwan AbdulhadiEditor and technology writer
Backported Patches for Older Apple Devices
Apple has officially backported security patches originally released last month to older iPhones and iPads, addressing a zero-day bug that has been actively exploited in extremely sophisticated targeted attacks on iOS devices, according to reports from [BleepingComputer](https://www.bleepingcomputer.com/news/apple/apple-backports-coregraphics-zero-day-patches-to-older-iphones/).
The latest wave of updates ensures protection for legacy hardware, including the iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. Previously, Apple [patched the same vulnerability](https://www.bleepingcomputer.com/news/security/apple-backports-zero-day-patches-to-older-iphones-and-ipads/) in September for devices running newer software such as iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
Details of the CoreGraphics Vulnerability
The security flaw originates in CoreGraphics, a framework utilized across iOS, macOS, iPadOS, watchOS, and tvOS for two-dimensional vector graphics, text drawing, and image rendering. Meta Product Security discovered the underlying [out-of-bounds write weakness](https://cwe.mitre.org/data/definitions/787.html), which has been officially tracked as [CVE-2026-86950](https://nvd.nist.gov/vuln/detail/cve-2026-86950).
When successfully exploited, out-of-bounds write security issues can allow attackers to crash running programs, corrupt vital data, or achieve remote code execution by writing information outside of the allocated memory buffer. Apple explained that processing a maliciously crafted file can result in arbitrary code execution, noting that the vulnerability was resolved through improved bounds checking.
Targeted Attacks and Official Warnings
In an advisory published by [Apple warned on Monday](https://support.apple.com/en-us/149225), the company acknowledged that it is aware of reports indicating the issue may have been exploited in an extremely sophisticated attack targeting specific individuals on iOS versions prior to iOS 27.
Although the tech giant emphasized that CVE-2026-86950 has only been utilized in highly targeted cyber operations, security experts strongly recommend that all eligible users install the newly backported patches immediately to block potential exploitation vectors.
Broader Context of Apple Security Updates
With this CoreGraphics fix, Apple has addressed two distinct zero-day vulnerabilities actively exploited in attacks throughout the year. Earlier this year, the company also mitigated an arbitrary code execution vulnerability in dyld—the Dynamic Link Editor utilized by Apple operating systems—which [was patched in February](https://www.bleepingcomputer.com/news/security/apple-fixes-zero-day-flaw-used-in-extremely-sophisticated-attacks/) after being similarly targeted in sophisticated attacks.
Additionally, Apple' security track record over the period includes addressing other significant issues, such as when it [fixed a high-severity Beats Studio Buds flaw](https://www.bleepingcomputer.com/news/security/apple-fixes-beats-studio-buds-flaw-that-let-hackers-spy-on-conversations/) that allowed unauthorized eavesdropping within Bluetooth range, and when it [patched older iPhones and iPads](https://www.bleepingcomputer.com/news/apple/apple-patches-older-iphones-and-ipads-against-coruna-exploits/) against threats tied to the Coruna exploit kit.
Sources
- BleepingComputerApple backports CoreGraphics zero-day patches to older iPhones
Continue chronologically
Related entity coverage
Related stories
Apple Patches CoreGraphics Zero-Day Exploited in Attacks
Apple has released security updates to fix a zero-day vulnerability in CoreGraphics that was exploited in targeted attacks against iOS devices.
Mozilla, Google, and Apple Block Weak eMudhra Certificates
Major tech vendors including Mozilla, Google, and Apple have blocked eight compromised eMudhra intermediate certificates featuring critically weak private keys.
iPhone Duo vs. iPad Mini: Which Apple Device Is Right For You?
Compare Apple's foldable iPhone Duo and the iPad Mini to determine which device fits your tablet, multitasking, and workflow needs.
Apple Releases iOS and macOS 27.2 With New Siri AI Features
Apple rolls out iOS and macOS 27.2 updates featuring new Siri AI capabilities, expanded language support, and a fresh Apple Music logo.
