Apple Backports CoreGraphics Zero-Day Fix to Older iPhones

Apple has released security updates for older iPhone and iPad hardware, backporting the patch for CVE-2026-86950, a CoreGraphics memory confusion flaw confirmed exploited in targeted attacks. Devices that cannot run iOS 26 now have a supported fix. BleepingComputer reported the backport October 27.

The vulnerability is CVSS 8.8 high. Apple’s original advisory described use in “extremely sophisticated” targeted attacks. CISA added it to the Known Exploited Vulnerabilities catalog on September 29, with a federal patch deadline of October 13. That deadline applied to devices already capable of receiving the September 28 patch. Older devices had no fix until now.

Coverage extended

The September 28 release covered iOS 26, iPadOS 26, macOS 26, and macOS 15. The backport extends that coverage to models running earlier iOS versions.

Exploitation status: confirmed in targeted attacks per Apple’s advisory. No evidence of mass exploitation. Devices unable to receive any available update remain exposed.

Patches are available through the standard iOS software update path. A backport update is present in the current iOS minor for affected older hardware.

Prior coverage: CoreGraphics PoC released, KEV deadline Oct 2, original Apple advisory.