Apple has released security updates for older iPhones and iPads to fix a zero-day vulnerability that was exploited in highly targeted attacks against specific users.
The flaw, tracked as CVE-2026-86950, was originally patched in September for newer Apple operating systems, including iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. Apple has now extended the protection to additional older devices.
Meta Product Security discovered the vulnerability in CoreGraphics, an Apple framework responsible for rendering images, text, and two-dimensional graphics. The flaw is an out-of-bounds write issue that could allow attackers to execute arbitrary code when a device processes a specially crafted malicious file.
Apple warned that it was aware of reports indicating the vulnerability may have been exploited in what it described as an “extremely sophisticated” attack targeting specific individuals running versions of iOS before iOS 27. The company addressed the issue by improving memory bounds checking.
The latest patches cover the iPhone XS, iPhone XS Max, iPhone XR, seventh-generation iPad, fourth-generation iPad Air and later models, ninth-generation iPad and later models, and sixth-generation iPad mini and later models.
Although Apple says the attacks were highly targeted, users with affected devices should install the available security updates as soon as possible to reduce the risk of exploitation.
This is the second zero-day vulnerability Apple has fixed after reports of sophisticated targeted attacks this year. In February, the company patched CVE-2026-20700, an arbitrary code execution flaw in dyld, the Dynamic Link Editor used by Apple operating systems.
Apple has also addressed other security issues this year, including a high-severity vulnerability in Beats Studio Buds that could allow attackers within Bluetooth range to spy on conversations, as well as vulnerabilities affecting older iPhones and iPads that were targeted in cyberespionage and cryptocurrency theft campaigns using the Coruna exploit kit.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
