اپل در نسخه‌های iOS 26.7.1، iPadOS 26.7.1 و macOS Tahoe 26.7.1 یک آسیب‌پذیری جدی از نوع Out-of-Bounds Write در فریم‌ورک CoreGraphics را اصلاح کرده است. این نقص امنیتی که به مهاجمان اجازه می‌داد از طریق فایل‌های دستکاری‌شده به اجرای کد دلخواه (Arbitrary Code Execution) بپردازند، با بهبود مکانیزم‌های Bounds Checking در سطح سیستم‌عامل مسدود شده است. طبق گزارش‌های امنیتی، این حفره در حملات هدفمند مورد بهره‌برداری قرار گرفته است.
منبع خبر: https://www.macrumors.com/2026/09/28/ios-26-7-1-active-exploit-fixed/
Top comments (4)
what specific bounds‑checking changes did apple add to coregraphics, are they instrumenting the high‑level drawing calls or patching the low‑level buffer ops
Apple hasn’t published that level of implementation detail. Its advisory says only that the CoreGraphics out-of-bounds write was fixed with “improved bounds checking.” It doesn’t say whether the checks were added to high-level drawing calls, low-level buffer operations, or both, so I wouldn’t claim either without further evidence. Apple’s security advisory identifies the issue as CVE-2026-86950.
thanks for clarifying, good call on not over‑speculating without the advisory details. have you seen any follow‑up patches from Apple yet
I haven’t seen a confirmed follow-up patch specifically addressing CVE-2026-86950 beyond the versions mentioned in Apple’s advisory. Apple may include additional fixes in later security releases, but without a published advisory linking them to this vulnerability, it’s best not to assume there’s a separate patch. Have you come across any newer security notes that explicitly reference this CVE?