Apple backports fix for exploited CoreGraphics zero-day CVE-2026-86950 to older iPhones and iPads (iOS 18.7.11)
Apple released security updates on October 26 that extend a fix for CVE-2026-86950, an out-of-bounds write in CoreGraphics, to older devices that cannot run iOS 26. The flaw was first fixed in iOS 26.7.1. The iOS 18.7.11 backport covers the iPhone XS, iPhone XS Max, iPhone XR and seventh-generation iPad. Apple says it is aware of a report that the bug may have been exploited in an "extremely sophisticated attack against specific targeted individuals" on versions of iOS before iOS 27.
Entenda a falha
A vulnerabilidade
CVE-2026-86950 is an out-of-bounds write in CoreGraphics, Apple's framework for graphics, images and PDF content. Processing a maliciously crafted file may lead to arbitrary code execution. The articles do not state the attack vector or whether authentication is needed. Apple first fixed it in iOS 26.7.1 and, on October 26, backported the fix in iOS 18.7.11 for iPhone XS, XS Max, XR and the seventh-generation iPad, which cannot run iOS 26. Apple says it is aware of a report of exploitation in an "extremely sophisticated attack against specific targeted individuals" on versions before iOS 27.
Como funciona
A crafted file reaches CoreGraphics when the system processes graphics, image or PDF content. While handling that file, the framework writes data outside the memory set aside for it. That out-of-bounds write corrupts adjacent memory, which can be steered into arbitrary code execution. The articles give no further detail on the exact parsing step where it fails.
Por que é vulnerável
The root cause is an out-of-bounds write: the software writes data outside the memory allocated for it, which points to a missing or insufficient bounds check on data from the file. The articles do not explain why it went unnoticed or what exactly the patch changes in the code. The iOS 18.7.11 update simply carries the existing fix to older devices.
Como foi descoberta
The articles do not say who found the flaw or how it was reported. Apple states it is aware of a report that the bug may have been exploited in an extremely sophisticated attack against specific targeted individuals. Malwarebytes reads this as Apple believing it was used in real attacks against a limited group, typically journalists, activists and officials. It reached the public through Apple's security updates of October 26.
Explicação gerada por IA a partir da matéria e dos artigos, em 01/11/2026 22:39.
Detalhes técnicos
- CVE-2026-86950 is an out-of-bounds write in CoreGraphics, Apple's framework for graphics, images and PDF content.
- Processing a maliciously crafted file may lead to arbitrary code execution.
- Apple's wording suggests use in real attacks against a limited group of users, typically journalists, activists and officials.
Remediação
- Update through Settings > General > Software Update, and enable Automatic Updates.
- On Mac, update through System Settings > General > Software Update. Safari updates ship with macOS.
- Users who may be targets of sophisticated spyware should update, restart the device and consider enabling Lockdown Mode.
Linha do tempo
-
Apple backports fix for exploited CoreGraphics zero-day CVE-2026-86950 to older iPhones and iPads (iOS 18.7.11)
ler a análise desta fonte ocultar
Apple released security updates on October 26 that extend a fix for CVE-2026-86950, an out-of-bounds write in CoreGraphics, to older devices that cannot run iOS 26. The flaw was first fixed in iOS 26.7.1. The iOS 18.7.11 backport covers the iPhone XS, iPhone XS Max, iPhone XR and seventh-generation iPad. Apple says it is aware of a report that the bug may have been exploited in an "extremely sophisticated attack against specific targeted individuals" on versions of iOS before iOS 27.
Technical Details
- CVE-2026-86950 is an out-of-bounds write in CoreGraphics, Apple's framework for graphics, images and PDF content.
- Processing a maliciously crafted file may lead to arbitrary code execution.
- Apple's wording suggests use in real attacks against a limited group of users, typically journalists, activists and officials.
Remediation
- Update through Settings > General > Software Update, and enable Automatic Updates.
- On Mac, update through System Settings > General > Software Update. Safari updates ship with macOS.
- Users who may be targets of sophisticated spyware should update, restart the device and consider enabling Lockdown Mode.