Apple backports CoreGraphics zero-day patches to older iPhones

Apple has extended last month's fix for a CoreGraphics zero-day to a wider range of older devices, including iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. The flaw, tracked as CVE-2026-86950 and discovered by Meta Product Security, is an out-of-bounds write bug in the CoreGraphics framework used for rendering graphics, text and images across Apple platforms. Apple says the issue was abused in highly targeted, technically advanced attacks against specific individuals running iOS versions prior to iOS 27, where a malicious file could trigger arbitrary code execution. This marks the second actively exploited zero-day Apple has fixed this year, following the dyld vulnerability CVE-2026-20700 patched back in February, and users of affected older devices are urged to install the backported update promptly.