Apple 將已被利用的 CoreGraphics 漏洞回推至舊版 iPhone 與 iPad
Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
Apple 將已被利用的 CoreGraphics 漏洞回推至舊版 iPhone 與 iPad。
- CVE-2026-86950：Out‑of‑bounds write，CVSS 8.8，可能導致任意程式碼執行。
Apple將高危 CoreGraphics 漏洞修補擴至舊版 iPhone 與 iPad，提醒使用者盡速升級以避免被利用。
Ravie LakshmananOct 27, 2026Vulnerability / Mobile Security
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices.
The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file.
Patches for the flaw were released last month by Apple in versions iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, acknowledging that it may have been exploited in sophisticated attacks against specific individuals using devices running iOS before iOS 27.
The fixes have now been expanded to include iOS 18.7.11 and iPadOS 18.7.11, which support iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27," the company said.
iOS 18.7.11 and iPadOS 18.7.11 also address a logic issue in Audio (CVE-2026-65339) that could be exploited by an app to leak sensitive user information and an access vulnerability in CoreMedia (CVE-2026-86990) that could be abused by a malicious app to access the camera without user permission.
The release comes as Apple shipped iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2, visionOS 27.2, and Safari 27.2, fixing hundreds of vulnerabilities, including many in AppleAVD, CoreAudio, ImageIO, kernel, Model I/O, Screen Sharing Server, Spotlight, StorageKit, and WebKit.
Notable among the defects is an authorization issue in Apple Intelligence (CVE-2026-86987) that could be exploited by a remote attacker to access sensitive user data. The iPhone maker said the issue was addressed in iOS and iPadOS with improved entitlement checks.
Although Apple makes no mention of any of these flaws being exploited in the wild, it's always a good practice to update the devices to the latest version for optimal protection.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.