CoreGraphics zero-day backported patches: Apple iOS/iPadOS — arbitrary code execution via crafted file (CVE-2026-86950)
Severity: high · Patch status: patched · Since 2026-10-27 · CVE-2025-20701, CVE-2026-20700, CVE-2026-86950
Apple backported September's CoreGraphics security patches to older iPhones and iPads, fixing CVE-2026-86950, an out-of-bounds write vulnerability discovered by Meta Product Security. Processing a maliciously crafted file can lead to arbitrary code execution. Apple says the bug may have been exploited in an 'extremely sophisticated' attack against specific targeted individuals on iOS versions before iOS 27; it was originally patched for iOS 26.7.1/iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. The backported patches now cover iPhone XS/XS Max/XR, iPad 7th generation, iPad Air 4th gen and later, iPad 9th gen and later, and iPad mini 6th gen and later. This is Apple's second exploited zero-day of 2026, after February's dyld flaw CVE-2026-20700. Users on supported older devices should install the updates promptly.
What to do
- Install the backported iOS/iPadOS updates on all eligible older iPhone and iPad models immediately
- Ensure macOS devices are on the September patches (macOS Tahoe 26.7.1 / Sequoia 15.8.1) or later
- Treat unexpected files/documents on iOS devices as potentially malicious; restrict to trusted sources
- Monitor for signs of targeted compromise on high-risk users' Apple devices
Fixed versions
- iOS/iPadOS backported patches (Oct 2026)
- iOS 26.7.1
- iPadOS 26.7.1
- macOS Tahoe 26.7.1
- macOS Sequoia 15.8.1
Sources
All live incidents on Threat Watch
