EN PT-BR
← Voltar ao feed
high

Apple backports fix for exploited CoreGraphics zero-day CVE-2026-86950 to iOS/iPadOS 18.7.11 alongside the 27.2 releases

5 fonte(s) · 5 atualização(ões) · publicado 27/10/2026 07:36 · coletado há 5 dias

Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 28/10/2026 00:05; os links antigos trazem para cá.

Fontes: thehackernews.com ↗ techcrunch.com ↗ gbhackers.com ↗ securityweek.com ↗ bleepingcomputer.com ↗

Apple released iOS 18.7.11 and iPadOS 18.7.11 on October 26, 2026 (gbhackers.com). They backport the fix for CVE-2026-86950, a CoreGraphics out-of-bounds write (CVSS 8.8, per thehackernews.com). Apple says the flaw may have been exploited in an "extremely sophisticated attack against specific targeted individuals" on iOS versions before iOS 27. Meta Product Security discovered the bug. It was first fixed in late September in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 (securityweek.com, bleepingcomputer.com). It is the second zero-day Apple has fixed this year as exploited in the wild, after CVE-2026-20700 in dyld, patched in February (bleepingcomputer.com). Apple has disclosed no attacker, victim count, file format or delivery mechanism, and the advisory does not confirm a zero-click attack or a specific spyware campaign (gbhackers.com). TechCrunch notes that this wording is standard for Apple when government spyware or law enforcement forensic tools are involved, but Apple gave no details on who exploited the bug (techcrunch.com). The backport shipped alongside the broad 27.2 release cycle (iOS/iPadOS 27.2, macOS Golden Gate 27.2 and others), which fixes hundreds of other flaws.

Entenda a falha

A vulnerabilidade

CVE-2026-86950 (CVSS 8.8, per The Hacker News) is an out-of-bounds write in Apple's CoreGraphics framework. Processing a maliciously crafted file can lead to arbitrary code execution. Apple says it may have been exploited in an "extremely sophisticated attack against specific targeted individuals" on iOS versions before iOS 27. iOS and macOS 27 do not appear to be affected, per SecurityWeek. Apple has not said whether user interaction is needed. It was first fixed in late September in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. On October 26, 2026, iOS/iPadOS 18.7.11 backported the fix to iPhone XS, XS Max, XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. The same release fixes CVE-2026-65339 (Audio logic issue, an app could leak sensitive data) and CVE-2026-86990 (CoreMedia access issue, a malicious app could use the camera without permission). No exploitation is reported for either. Separately, the 27.2 releases fix CVE-2026-86987, an Apple Intelligence authorization issue that a remote attacker could use to reach sensitive data. No exploitation is reported for it.

Como funciona

According to the advisory, the trigger is a maliciously crafted file that the device processes through CoreGraphics, the framework that renders 2D vector graphics, text and images on Apple platforms. While handling that file, the framework writes data beyond the end of the memory buffer it allocated. That memory corruption can then lead to arbitrary code execution. Apple does not say which file format is involved, how the file is delivered, whether the victim must open it, or whether the flaw was chained with others. A zero-click attack or a specific spyware campaign is therefore not confirmed. SecurityWeek says there seems to be no public information on the attacks.

Por que é vulnerável

The root cause is an out-of-bounds write, a memory corruption bug where CoreGraphics modifies memory beyond its designated boundary while processing a file. Apple describes the fix as improved bounds checking, so the code now validates buffer limits before writing. The articles do not explain why the bug went unnoticed before it was exploited.

Como foi descoberta

Apple credits Meta Product Security with discovering CVE-2026-86950. Apple says it is aware of a report that the flaw may have been exploited, but has not disclosed the attackers, the number of victims or when the activity occurred. TechCrunch notes that this wording is standard for Apple when government spyware or law enforcement forensic tools are involved, but Apple gave no specifics. It was disclosed through Apple's security advisories: fixed in late September for current systems, then backported on October 26, 2026 to older iPhones and iPads. It is the second Apple zero-day exploited this year, after CVE-2026-20700 in dyld, patched in February. CVE-2026-65339 is credited to Mustafa Calap (@ordinal0, dbg.re) and Nik Tsytsarkin of Meta Red Team X, and CVE-2026-86990 to Mustafa Calap.

Explicação gerada por IA a partir da matéria e dos artigos, em 28/10/2026 00:20.

Detalhes técnicos

  • CVE-2026-86950 is an out-of-bounds write in CoreGraphics, the framework for 2D vector graphics, text drawing and image rendering across Apple platforms. Processing a maliciously crafted file may lead to arbitrary code execution. Apple fixed it with improved bounds checking (bleepingcomputer.com, gbhackers.com).
  • iOS and macOS 27 do not appear to be affected (securityweek.com). Exploitation was reported on iOS versions before iOS 27.
  • iOS/iPadOS 18.7.11 also fixes two other flaws. Apple does not report exploitation for either, and no CVSS scores are given for them (gbhackers.com):
    • CVE-2026-65339: a logic issue in Audio that could let an app leak sensitive user information. It is credited to Mustafa Calap (@ordinal0, dbg.re) and Nik Tsytsarkin (Meta Red Team X).
    • CVE-2026-86990: an access-control issue in CoreMedia that could let a malicious app access the camera without permission. It is credited to Mustafa Calap.
  • Devices covered by the backport: iPhone XS, XS Max, XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later (bleepingcomputer.com, thehackernews.com).
  • iOS/iPadOS 27.2 fixes 163 flaws and macOS Golden Gate 27.2 fixes 263, with roughly 140 shared. Apple patched 286 flaws across the newest iOS and macOS versions (securityweek.com).
    • iOS/iPadOS 27.2 fixes memory corruption in WebKit, the kernel and image, font, PDF, audio and video components, some allowing code execution. It also fixes privacy bypasses, WebContent sandbox escapes, a Kerberos KDC impersonation issue and a bug giving a nearby attacker access to a Thread network.
    • macOS 27.2 fixes more than a dozen privilege escalation flaws giving apps root, plus sandbox escapes, Gatekeeper bypasses and kernel memory corruption. Numerous Screen Sharing, Remote Management and SMB flaws are reachable remotely or from the local network, including a Remote Management bug allowing remote code execution.
  • Other releases: iOS/iPadOS 26.7.2 (134 fixes), macOS Tahoe 26.7.2 (213), macOS Sequoia 15.8.2 (197), tvOS 27.2 (72), watchOS 27.2 (62), visionOS 27.2 (125) and Safari 27.2 (33) (securityweek.com).
  • CVE-2026-86987 is an Apple Intelligence authorization issue that a remote attacker could use to access sensitive user data. It was fixed with improved entitlement checks, and Apple does not report exploitation (thehackernews.com).

Remediação

  • Update older iPhones and iPads to iOS/iPadOS 18.7.11 without delay, since exploitation is acknowledged.
  • Update current devices to the 27.2 branch. Devices on the 26 branch should move to the latest 26.7.x release, and Mac users to the latest macOS Tahoe, Sequoia or Golden Gate release (securityweek.com, thehackernews.com).
  • High-risk individuals should prioritize the update (techcrunch.com).
  • Do not rely on assumed file extensions or delivery channels, because the advisory does not identify them. It also gives no guidance for devices that may already be compromised (gbhackers.com).

Relatos divergentes

  • Fix date: bleepingcomputer.com and thehackernews.com say the first fix came in "September" or "last month", while securityweek.com says "late September". These are compatible, and the later sources are more specific.
  • Device list: gbhackers.com lists only iPhone XS, XS Max, XR and iPad 7th generation for the 18.7.11 release. bleepingcomputer.com and thehackernews.com list a broader set that includes newer iPads. gbhackers.com appears to give a partial listing.
  • iOS 27.2 fix count: techcrunch.com says "160+", securityweek.com says 163, and thehackernews.com says only "hundreds" across all platforms. These are consistent once the counts are split by platform.
  • CVE detail: techcrunch.com names no CVE, component or chain, while the other four sources identify CVE-2026-86950 and CoreGraphics. The CVE-specific sources are more authoritative.
  • Remediation baseline: thehackernews.com cites 26.7.1 as the fixed release for the 26 branch, but securityweek.com reports later 26.7.2 releases, so 26.7.2 is the more current target.

Linha do tempo

  1. thehackernews.com ↗ · pub. 27/10/2026 10:59 · coletado 27/10 15:00

    Apple backports fix for exploited CoreGraphics flaw CVE-2026-86950 to older iPhones and iPads

    thehackernews.com adds the CVSS score (8.8) for CVE-2026-86950 and notes that the backport came alongside the iOS/iPadOS/macOS/tvOS/watchOS/visionOS/Safari 27.2 releases, which fix hundreds of vulnerabilities, including the Apple Intelligence authorization flaw CVE-2026-86987. Apple does not report exploitation for these other flaws.

    ler a análise desta fonte

    thehackernews.com adds the CVSS score (8.8) for CVE-2026-86950 and notes that the backport came alongside the iOS/iPadOS/macOS/tvOS/watchOS/visionOS/Safari 27.2 releases, which fix hundreds of vulnerabilities, including the Apple Intelligence authorization flaw CVE-2026-86987. Apple does not report exploitation for these other flaws.

    Apple backported the fix for CVE-2026-86950 (CVSS 8.8), a CoreGraphics out-of-bounds write exploited in real-world attacks, to older devices on Monday. The flaw allows arbitrary code execution when a maliciously crafted file is processed. Apple first patched it last month in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. It says the flaw may have been exploited in an "extremely sophisticated attack against specific targeted individuals" on iOS versions before iOS 27. The backport ships as iOS 18.7.11 and iPadOS 18.7.11, alongside the broader iOS 27.2 release cycle, which fixes hundreds of vulnerabilities.

    Technical Details

    • CVE-2026-86950 is an out-of-bounds write in CoreGraphics that can lead to arbitrary code execution via a crafted file.
    • iOS/iPadOS 18.7.11 supports iPhone XS, XS Max, XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
    • The same update fixes CVE-2026-65339 (Audio logic issue that could let an app leak sensitive user information) and CVE-2026-86990 (CoreMedia access issue that could let a malicious app access the camera without permission).
    • iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2, visionOS 27.2 and Safari 27.2 fix hundreds of flaws in components including AppleAVD, CoreAudio, ImageIO, kernel, Model I/O, Screen Sharing Server, Spotlight, StorageKit and WebKit.
    • Among them is CVE-2026-86987, an authorization issue in Apple Intelligence that a remote attacker could exploit to access sensitive user data. Apple fixed it with improved entitlement checks.
    • Apple does not report exploitation for any of these other flaws.

    Remediation

    • Update older devices to iOS/iPadOS 18.7.11 and current devices to the latest releases (27.2 branch, or 26.7.1 where applicable).
  2. techcrunch.com ↗ · pub. 27/10/2026 10:54 · coletado 27/10 11:00

    Apple iOS 27.2 ships 160+ security fixes, backports patch for bug exploited in 'extremely sophisticated' targeted attack

    ler a análise desta fonte

    Apple released iOS 27.2 for iPhone and iPad, which includes more than 160 security fixes according to the company's release documentation, alongside feature updates such as expanded Siri AI language support. Many fixes were backported to iOS 26, which Apple says about 80% of iPhone owners still run. Apple also backported one specific fix to iOS 18 for a bug that it says may have been exploited "in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." The article notes this is standard Apple wording for compromises involving government spyware or law enforcement forensic devices, but Apple gave no details on the exploiting party.

    Technical Details

    • The article does not name CVE identifiers, the affected component, or the exploitation chain.
    • Exploitation was reported as targeted and limited to specific individuals, on iOS versions before iOS 27.
    • No attribution or IOCs were provided.

    Remediation

    • Update to iOS 27.2, or install the backported security updates for iOS 26 and iOS 18.
    • High-risk individuals should prioritize the update, because the backported fix addresses a bug possibly exploited in a targeted attack.
  3. gbhackers.com ↗ · pub. 27/10/2026 07:54 · coletado 27/10 09:00

    Apple patches CoreGraphics zero-day CVE-2026-86950 exploited in targeted attacks in iOS/iPadOS 18.7.11, plus two other flaws

    The article reports the October 26, 2026 release of iOS/iPadOS 18.7.11 carrying the CVE-2026-86950 fix. It adds two other fixed flaws, CVE-2026-65339 (Audio) and CVE-2026-86990 (CoreMedia), with their credited researchers. It also stresses that the advisory gives no attacker, victim, file format or delivery details and does not confirm a zero-click attack.

    ler a análise desta fonte

    The article reports the October 26, 2026 release of iOS/iPadOS 18.7.11 carrying the CVE-2026-86950 fix. It adds two other fixed flaws, CVE-2026-65339 (Audio) and CVE-2026-86990 (CoreMedia), with their credited researchers. It also stresses that the advisory gives no attacker, victim, file format or delivery details and does not confirm a zero-click attack.

    Apple released iOS 18.7.11 and iPadOS 18.7.11 on October 26, 2026, fixing three vulnerabilities, including the CoreGraphics zero-day CVE-2026-86950. Apple says it is aware of a report that the flaw may have been exploited in an "extremely sophisticated attack against specific targeted individuals" on iOS versions before iOS 27. The bug was reported by Meta Product Security. Apple has not disclosed the attackers, the number of victims, the file format, the delivery mechanism or whether user interaction is required, so the advisory does not confirm a zero-click attack or a specific spyware campaign.

    Technical Details

    • CVE-2026-86950: out-of-bounds write in CoreGraphics; processing a maliciously crafted file may lead to arbitrary code execution. Fixed with improved bounds checking.
    • CVE-2026-65339: logic issue in the Audio component that could let an app leak sensitive user information. Fixed with improved checks. Credited to Mustafa Calap (@ordinal0, dbg.re) and Nik Tsytsarkin (Meta Red Team X).
    • CVE-2026-86990: access-control issue in CoreMedia that could let a malicious app access the camera without permission. Credited to Mustafa Calap.
    • Apple does not report exploitation for the Audio and CoreMedia flaws and gives no CVSS scores.
    • Release listing: iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation.

    Remediation

    • Install iOS/iPadOS 18.7.11 on the affected devices without delay, given the acknowledged exploitation.
    • Prioritize patching over relying on assumed file extensions or delivery channels, which the advisory does not identify.
    • The advisory gives no guidance for devices that may already be compromised.
  4. securityweek.com ↗ · pub. 27/10/2026 08:49 · coletado 27/10 09:00

    Apple patches 286 flaws in iOS/macOS 27.2 and backports fix for exploited zero-day CVE-2026-86950 to iOS 18

    ler a análise desta fonte

    Apple released security updates on Monday covering iOS and iPadOS 27.2, macOS Golden Gate 27.2 and other platforms, addressing 286 vulnerabilities across the newest iOS and macOS versions. Apple also backported the fix for CVE-2026-86950, a zero-day exploited in what it called an "extremely sophisticated attack", to iOS and iPadOS 18.7.11. The flaw was discovered by Meta's product security team and was first fixed in late September in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. No public information describes the attacks that exploited it.

    Technical Details

    • macOS Golden Gate 27.2 fixes 263 flaws and iOS/iPadOS 27.2 fixes 163, with roughly 140 shared between them.
    • iOS/iPadOS 27.2 fixes many memory corruption bugs in WebKit, the kernel and image, font, PDF, audio and video components, some allowing arbitrary code execution. It also fixes privacy preference bypasses, apps accessing sensitive data, WebContent sandbox escapes, a Kerberos KDC impersonation issue, and a bug that could give a nearby attacker access to a Thread network.
    • macOS 27.2 fixes more than a dozen privilege escalation flaws giving apps root, sandbox escapes, Gatekeeper bypasses and kernel memory corruption in file system and disk image components. Numerous Screen Sharing, Remote Management and SMB flaws are reachable remotely or from the local network, including a Remote Management bug allowing remote arbitrary code execution.
    • iOS/iPadOS 18.7.11 fixes three vulnerabilities, including CVE-2026-86950. iOS and macOS 27 do not appear to be affected by it.
    • Other releases: iOS/iPadOS 26.7.2 (134 fixes), macOS Tahoe 26.7.2 (213), macOS Sequoia 15.8.2 (197), tvOS 27.2 (72), watchOS 27.2 (62), visionOS 27.2 (125) and Safari 27.2 (33).

    Remediation

    Apply the updates across all Apple platforms. Devices still on iOS/iPadOS 18 should move to 18.7.11 to close the exploited CVE-2026-86950.

  5. bleepingcomputer.com ↗ · pub. 27/10/2026 07:36 · coletado 27/10 09:00 primeiro registro

    Apple backports fix for CoreGraphics zero-day CVE-2026-86950 exploited in targeted attacks to older iPhones and iPads

    ler a análise desta fonte

    Apple has backported to older iPhone and iPad models the patch for CVE-2026-86950, a CoreGraphics out-of-bounds write zero-day exploited in an "extremely sophisticated" attack against specific targeted individuals. The flaw was discovered by Meta Product Security and first fixed in September in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Apple says it is aware of a report that the issue may have been exploited on iOS versions before iOS 27. This is the second zero-day Apple has fixed this year as exploited in the wild, after CVE-2026-20700 in dyld (patched in February).

    Technical Details

    • CVE-2026-86950 is an out-of-bounds write in CoreGraphics, the framework for 2D vector graphics, text drawing and image rendering across iOS, macOS, iPadOS, watchOS and tvOS.
    • Processing a maliciously crafted file may lead to arbitrary code execution; the fix adds improved bounds checking.
    • Newly covered devices: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.

    Remediation

    • Install the backported iOS/iPadOS updates on the affected older devices, and the September updates on current devices (iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1).
    • Although exploitation is limited to highly targeted attacks, prompt patching is strongly advised.