Apple has shipped backported patches for a CoreGraphics zero-day it fixed on current software in September. The flaw, CVE-2026-86950, had until now been closed only on devices that could run iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1.
What happened
CoreGraphics handles image rendering and text drawing across Apple's platforms. An out-of-bounds write in that framework lets a maliciously crafted file run code when the system processes it. Apple fixed the issue with improved bounds checking.
Apple states it is aware of a report that the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27. Meta Product Security found the bug and reported it.
The new release this week covers iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
Who is affected
Any Apple device still running a release older than the fixed versions is exposed until it is updated.
- iPhone XS, XS Max and XR, which sit below the iOS 27 cutoff
- iPad 7th generation and other iPad models that stopped at an older iPadOS release
- Macs on macOS builds earlier than Tahoe 26.7.1 or Sequoia 15.8.1
- Users who open files received by email, chat or download and have not installed the September updates
What to do now
Update every Apple device in the business, and check the ones that never get touched: shared iPads, reception tablets, demo units and the phones of staff who refuse upgrades.
- Install the current iOS or iPadOS release on each device, then confirm the version in Settings, General, About
- For Macs, apply the macOS security update and reboot rather than deferring it
- Replace hardware too old to receive the fix, since no patch is coming for it
- Keep the rule that files from unknown senders are not opened on unpatched devices
What this means for South African businesses
Apple's wording matters. This is described as a targeted attack, not a mass campaign, so a small business is unlikely to be the intended victim. The practical exposure is the neglected device: an iPad used for stock takes or a director's old iPhone that has not been updated in a year, sitting on the same network and mail account as everything else.
An inventory that records the OS version of every phone and tablet is worth more than a patching policy nobody applies to mobile hardware.
Source: BleepingComputer
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.