Apple Pushes Broad Security Updates and Backports CoreGraphics Zero‑Day to Older iPhones
The patches close a file‑processing flaw that could let a malicious file run code on devices that cannot install the newest iOS.
Overview
- Apple updated its security releases on Monday and shipped system updates that together address 329 unique vulnerabilities with 1,265 CVE listings across iOS, iPadOS, macOS, watchOS, tvOS, visionOS, and Safari.
- The company explicitly backported a CoreGraphics out‑of‑bounds write tracked as CVE‑2026‑86950 to older iPhones and iPads after crediting Meta Product Security for the discovery and warning the flaw may have been used in extremely sophisticated targeted attacks.
- Apple says processing a maliciously crafted image, PDF, font, or similar file could allow arbitrary code execution by exploiting the CoreGraphics bug and that the fix adds stricter bounds checking to prevent out‑of‑bounds writes.
- Apple credited AI tools and multiple research teams for speeding discovery of WebKit and other flaws, a trend that contributed to the volume of fixes in this release and to an uptick in rapid patching this year.
- Users and organizations should install the updates immediately because some affected devices cannot run the latest OS and federal guidance has already treated the CoreGraphics flaw as a high‑priority remediation to block potential targeted spyware attacks.