Story perspectives

Apple patches CoreGraphics bug enabling iPhone arbitrary code execution

By Drooid · Sep 29, 2026, 6:22 PM UTC · How we work

Summary

Story summary

Apple released security updates fixing CVE-2026-86950 in iOS 26, iPadOS 26 and macOS 26.
Meta Product Security discovered the CoreGraphics out-of-bounds write bug that enables arbitrary code execution.
The flaw resides in CoreGraphics, the main graphics engine with broad OS access.
Almost four-in-five iPhone users remain on iOS 26, leaving the vulnerability widely present.
Devices running iOS 27, iPadOS 27 and macOS 27 are not vulnerable to this bug.

1 of 1

Story summary

Apple released security updates fixing CVE-2026-86950 in iOS 26, iPadOS 26 and macOS 26.
Meta Product Security discovered the CoreGraphics out-of-bounds write bug that enables arbitrary code execution.
The flaw resides in CoreGraphics, the main graphics engine with broad OS access.
Almost four-in-five iPhone users remain on iOS 26, leaving the vulnerability widely present.
Devices running iOS 27, iPadOS 27 and macOS 27 are not vulnerable to this bug.