- Apple backported a high-severity patch for CVE-2026-86950, an out-of-bounds write in CoreGraphics exploited in targeted attacks.
- The vulnerability previously addressed in iOS 26.7.1 and macOS updates is now fixed for older devices running iOS 18.7.11 and iPadOS 18.7.11.
- The same update also closes two additional flaws: a logic issue in Audio (CVE-2026-65339) and an access bug in CoreMedia (CVE-2026-86990).
- Concurrently, Apple shipped iOS 27.2 and other major OS updates, resolving hundreds of vulnerabilities across AppleAVD, Kernel, WebKit, and more.
Apple on Monday backported fixes for a high-severity security flaw that attackers had already exploited in extremely sophisticated attacks against specific individuals on devices running iOS before version 27. The vulnerability, tracked as CVE-2026-86950 (CVSS 8.8), involves an out-of-bounds write in CoreGraphics that could allow arbitrary code execution when processing a maliciously crafted file.
Apple originally patched the flaw last month in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. Now the company has expanded coverage to iOS 18.7.11 and iPadOS 18.7.11, supporting older models such as iPhone XS, iPhone XR, and iPad 7th generation and later. “Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27,” the company stated.
The same updates also address a logic issue in Audio (CVE-2026-65339) that could leak sensitive user information and an access vulnerability in CoreMedia (CVE-2026-86990) that could let a malicious app access the camera without permission. Meanwhile, Apple shipped iOS 27.2, macOS Golden Gate 27.2, and several other OS updates, fixing hundreds of vulnerabilities across AppleAVD, Kernel, and WebKit. Notably, an authorization issue in Apple Intelligence (CVE-2026-86987) could have allowed remote attackers to access sensitive user data, which Apple addressed with improved entitlement checks. Although no other flaws were reported as exploited in the wild, updating devices to the latest version remains the best defense.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
