Exploited CoreGraphics flaw patched on older iPhones and iPads
The CoreGraphics flaw, a weakness in Apple’s graphics-processing framework, has now been patched on additional older iPhones and iPads through iOS 18.7.11 and iPadOS 18.7.11. Apple released the updates on Monday as a backport, meaning a security correction originally issued for newer software has been adapted for older supported versions. Apple says the vulnerability may have been used in an extremely sophisticated attack against specifically targeted individuals.
Tracked as CVE-2026-86950, the high-severity vulnerability has a Common Vulnerability Scoring System (CVSS) rating of 8.8 on the standard 10-point scale. It is an out-of-bounds write, an error that can allow software to place data outside the area of memory reserved for it. Processing a maliciously constructed file could consequently lead to arbitrary code execution, which means the file could cause the device to run commands chosen by an attacker.
Apple first fixed CVE-2026-86950 last month in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. At the time, the company acknowledged a report that the flaw might have been exploited in attacks against selected people using versions of iOS earlier than iOS 27. Apple has not identified an attacker or provided further information about the malicious files, affected individuals or attack method, so those details remain unknown.
The expanded fixes in iOS 18.7.11 and iPadOS 18.7.11 cover iPhone XS, iPhone XS Max and iPhone XR. Supported tablets listed for the updates are iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. Owners of these devices should install the newest update offered through the device’s software update settings rather than assuming that an older model is outside the patch cycle.
The two updates also correct separate privacy and security weaknesses. CVE-2026-65339 is a logic issue in Audio that could let an app disclose sensitive user information. CVE-2026-86990 is an access-control vulnerability in CoreMedia, Apple’s media-processing framework, that could allow a malicious app to use the camera without the user’s permission. The source does not state that either of these two issues has been exploited in real attacks.
Alongside the backported patches, Apple released iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2, visionOS 27.2 and Safari 27.2. These releases address hundreds of vulnerabilities across components including AppleAVD, CoreAudio, ImageIO, the kernel, which is the central part of an operating system, Model I/O, Screen Sharing Server, Spotlight, StorageKit and WebKit.
One notable issue in that broader set is CVE-2026-86987, an authorization weakness in Apple Intelligence. Apple says a remote attacker could exploit it to obtain sensitive user data. The company addressed the issue in iOS and iPadOS by improving entitlement checks, the controls used to confirm whether software has permission to use a protected capability or resource. Apple has not indicated that this vulnerability or the other flaws in the version 27.2 releases were being exploited in the wild.
For website owners and IT teams, the practical concern is that phones and tablets used for administration, communications or access to business systems still require timely operating-system maintenance. For businesses seeking support with that broader responsibility, AEU-I provides security-first IT, infrastructure and consulting. The immediate priority for affected users is to install the available operating-system update, because CVE-2026-86950 has already been associated with real-world exploitation and can be triggered through file processing.