**Apple** has recently backported crucial security patches to a wider range of older **iPhones** and **iPads**. These updates address a zero-day vulnerability, tracked as **CVE-2026-86950**, which has been actively exploited in what **Apple** describes as "extremely sophisticated" targeted attacks on **iOS** devices. ### The CoreGraphics Zero-Day The vulnerability, identified as an out-of-bounds write weakness, resides within **CoreGraphics**. This fundamental framework is integral to two-dimensional vector graphics, text drawing, and image rendering across **Apple's** operating systems, including **iOS**, **macOS**, **iPadOS**, **watchOS**, and **tvOS**. **Meta Product Security** is credited with its discovery. Successful exploitation of out-of-bounds write issues can have severe consequences, potentially leading to program crashes, data corruption, or even remote code execution by allowing attackers to write data beyond allocated memory buffers. **Apple** stated, "**Apple** is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of **iOS** before **iOS 27**." The company further warned that "Processing a maliciously crafted file may lead to arbitrary code execution. An out-of-bounds write issue was addressed with improved bounds checking." ### Affected Devices and Recommendations While patches for devices running **iOS 26.7.1**, **iPadOS 26.7.1**, **macOS Tahoe 26.7.1**, and **macOS Sequoia 15.8.1** were released last month, this week's updates extend protection to: * **iPhone XS** * **iPhone XS Max** * **iPhone XR** * **iPad 7th generation** * **iPad Air 4th generation** and later * **iPad 9th generation** and later * **iPad mini 6th generation** and later Despite **Apple's** assertion that **CVE-2026-86950** is primarily exploited in highly targeted attacks, the cybersecurity community strongly advises all users to install these backported patches without delay to mitigate potential risks. ### A Pattern of Targeted Exploits This marks the second zero-day vulnerability exploited in attacks that **Apple** has addressed this year. The first, **CVE-2026-20700**, was an arbitrary code execution flaw in **dyld** (the Dynamic Link Editor) and was also exploited in "extremely sophisticated" targeted attacks, receiving a patch in February. Earlier this year, **Apple** also resolved **CVE-2025-20701**, a high-severity flaw in **Beats Studio Buds** that could enable attackers within Bluetooth range to eavesdrop on conversations. Additionally, older **iPhones** and **iPads** were patched against four vulnerabilities exploited by the **Coruna** exploit kit in cyberespionage and crypto-theft campaigns.