CVE-2026-86950: Apple Backports Fix for Exploited CoreGraphics Flaw

# CVE-2026-86950: Apple Backports Fix for Exploited CoreGraphics Flaw

https://gcdradar.vercel.app/incidents/cve-2026-86950-apple-backports-fix-for-exploited-coregraphic · AIR-2026-1591 · closed 2026-11-10

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Confirmed exploitation in the wild with vendor patch.
- Fix status: Patched
- First reported: 2026-10-27
- AI role: No AI role
- Products: CoreGraphics, iOS, iPadOS
- CVE ids: CVE-2026-86950
- CVSS: 8.8

## Summary

Apple backported patches for an out-of-bounds write vulnerability in CoreGraphics that was exploited in real-world attacks. The flaw could result in arbitrary code execution when processing a malicious file.

## What to do

Update affected iPhones and iPads to the latest backported software versions.

## Affected and fixed versions

- Affected: iOS < 18
- Fixed in: iOS 18 and newer backports

## Latest updates

- 2026-10-27: iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18 (https://securityweek.com/ios-macos-27-2-patch-286-bugs-fix-for-exploited-flaw-backported-to-ios-18)
- 2026-10-27: Apple backports CoreGraphics zero-day patches to older iPhones (https://bleepingcomputer.com/news/apple/apple-backports-coregraphics-zero-day-patches-to-older-iphones)
- 2026-10-27: Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads (https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html)

## Sources

- 2026-10-27 The Hacker News: Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html
- 2026-10-27 BleepingComputer: Apple backports CoreGraphics zero-day patches to older iPhones https://bleepingcomputer.com/news/apple/apple-backports-coregraphics-zero-day-patches-to-older-iphones
- 2026-10-27 SecurityWeek: iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18 https://securityweek.com/ios-macos-27-2-patch-286-bugs-fix-for-exploited-flaw-backported-to-ios-18

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.