Apple patches CoreGraphics bug that may have been used in targeted iPhone attacks

An out-of-bounds write happens when software puts data past the end of the memory it was allocated ^[6]. The stray data can overwrite whatever sits next to it or crash the program. It can also give an attacker control of the process doing the writing ^[6]. For CVE-2026-86950, that is the process handling the crafted file ^[6]. Apple fixed it with improved bounds checking ^[5].

The CVE number, the framework, the bug class and the fixed builds are all public ^[4][5][3]. The claim of exploitation is second-hand and hedged. Apple said it is aware of a report that the issue may have been exploited in an "extremely sophisticated attack" against specific people using versions of iOS before iOS 27 ^[7]. The Malwarebytes account does not name the attacker, the targets or how the file reached them, so on this evidence the activity cannot be tied to a known campaign ^[7].

The iOS 27 cutoff tells a fleet team which phones to push first. Any iPhone on an iOS 26 build below 26.7.1 falls inside the version range the report describes and does not have the fix ^[9]. Devices already on iOS 27 are outside that range ^[7]. The range comes from an attack report, so it sets priority. It is not a vulnerability assessment of iOS 27. iPads on iPadOS 26 take the same 26.7.1 build ^[3], though the report as Malwarebytes relays it concerns iPhone users ^[2].