Apple Patches Core Graphics Flaw Possibly Exploited in Targeted Attacks
Summary: Apple released security updates for older versions of iOS, iPadOS, and macOS to fix CVE-2026-86950, an out-of-bounds write in the CoreGraphics component that could allow arbitrary code execution when processing a maliciously crafted file. Apple said the issue was addressed with improved bounds checking, credited Meta Product Security with reporting it, and stated it is aware of a report that the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
Key Takeaway: CISA added CVE-2026-86950 to its Known Exploited Vulnerabilities catalog on September 29, 2026, requiring federal agencies to apply the fixes by October 2, 2026 - a three-day window that signals how urgently the flaw is being treated.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-20700CVE-2026-86950
- Related
- CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Sep 29, 2026CVE-2026-20700: Apple Multiple Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Feb 12, 2026