CVE-2026-86950
Known exploited · CISA KEV
CVSS 8.8 HIGH: an out-of-bounds write issue was addressed with improved bounds checking.
CISA federal remediation date Oct 2 · date passed
Vulnerabilities & Exploits · Zero-Day Exploit
Apple has backported the fix for exploited CoreGraphics zero-day CVE-2026-86950 to iOS and iPadOS 18.7.11, after patching it in newer releases in late September. Meta’s product security team discovered the flaw, which Apple said was used in an “extremely sophisticated attack.”
CoreGraphics handles graphics and image content; the flaw was an out-of-bounds write, meaning crafted content could make it write beyond the memory set aside for it. Apple has not disclosed how attackers delivered that content or what a victim needed to do, so the public record does not show the attack path.
For organizations still managing iOS 18, 18.7.11 closes a gap left by fixes for newer releases—but update compliance cannot show whether a device was targeted or compromised. The patch narrows the known exposure; the extent of the campaign remains unknown.
3 sources · 3h ago
Known exploited · CISA KEV
CVSS 8.8 HIGH: an out-of-bounds write issue was addressed with improved bounds checking.
CISA federal remediation date Oct 2 · date passed
The Hacker News
Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
Apple backports fixes for CVE-2026-86950 to older iPhones and iPads after reports of possible targeted exploitation of the CoreGraphics flaw.
originalSecurityWeek
iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
Apple patched 286 vulnerabilities in iOS and macOS 27.2 and brought the fix for an exploited CoreGraphics zero-day to older iPhones.
originalBleepingComputer
Apple backports CoreGraphics zero-day patches to older iPhones
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in
originalPart of the PlainSec briefing for 2026-10-27
Every edition of this story: Apple extends exploited CoreGraphics fix to iOS 18