Apple pushed its fix for an already-exploited CoreGraphics bug back to older iPhones

Apple’s security-releases page now lists iOS 18.7.11 and iPadOS 18.7.11, dated October 26, 2026, and the entry that matters carries CVE-2026-86950, a CoreGraphics out-of-bounds write that Apple says may have been used against specific people. The same flaw was fixed on current software in September; the new releases carry that fix to iPhones and iPads that remain on the older iOS 18 branch. Apple’s own wording stops short of confirming an attack: it is aware of a report that the issue “may have been exploited.”

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

The backport arrives weeks after the original patch, and after a U.S. government agency placed the bug on its list of known exploited vulnerabilities.

What Apple’s iOS 18.7.11 entry says

The advisory for iOS 18.7.11 and iPadOS 18.7.11 describes the impact as “Processing a maliciously crafted file may lead to arbitrary code execution,” and the fix as “An out-of-bounds write issue was addressed with improved bounds checking.” Credit goes to Meta Product Security. The exploitation sentence reads: “Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” Apple’s text names no victims, no count and no delivery method, and Security Affairs reported that the company has disclosed none of them. The Hacker News, reporting the backport on October 27, put the severity at CVSS 8.8.

CoreGraphics is Apple’s 2D graphics framework, which is why the entry speaks of a crafted file: an image or document that reaches the framework can be enough to trigger a write past the end of a memory buffer, and in the worst case the attacker’s code then runs with the privileges of the app that opened the file.

Which older devices get the fix

Apple’s security releases index lists the iOS 18.7.11 row as available for the iPhone XS, iPhone XS Max, iPhone XR and the iPad 7th generation, with a release date of October 26, 2026. The advisory text adds the iPad Air 4th generation and later, the iPad 9th generation and later, and the iPad mini 6th generation and later; the page runs several of those entries together, and The Hacker News lists the same set. Apple’s index is the authoritative list of which hardware sits on this branch.

The device lists also show where the dividing line falls. The 27.2 advisory says most of its fixes apply to the iPhone 11 and later, and to iPad models beginning with the iPad Air 4th generation, the iPad 9th generation and the iPad mini 6th generation. The iPhone XS, XS Max and XR sit below that iPhone cutoff, so 18.7.11 is the only release for them in the Apple pages reviewed for this report. For those phones, the backport is the whole of Apple’s answer to the bug.

The sequence shows how a fix moves through Apple’s lineup. According to Security Affairs, the original patch shipped in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, covering devices on iOS 26.7 and earlier, meaning anything before iOS 27. The older iPhones in the October release received theirs only after that. The 18.7.11 advisory repeats Apple’s scoping phrase, “versions of iOS before iOS 27.”

From Apple’s hedge to CISA’s catalogue

The word “exploited” in coverage traces less to Apple than to the U.S. Cybersecurity and Infrastructure Security Agency. Security Affairs reported that CISA added CVE-2026-86950 to its Known Exploited Vulnerabilities catalog on September 29, 2026, with an October 2 remediation date for federal agencies, and labelled the entry an “Apple Multiple Products” flaw. CISA’s own alert page could not be retrieved during this run, so the date rests on that report.

Two statuses therefore sit side by side. Apple’s advisory language is conditional, a report that the issue may have been exploited in a targeted attack. The federal catalogue is a list of vulnerabilities with evidence of active exploitation. Neither source says who was targeted or how the malicious files reached them.

Two companion fixes and the 27.2 release

The 18.7.11 releases are not a single-bug update. According to The Hacker News, they also address CVE-2026-65339, a logic issue in Audio that could let an app leak sensitive user information, and CVE-2026-86990, an access issue in CoreMedia that could let a malicious app reach the camera without the user’s permission. Neither is described as exploited.

Apple shipped iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2 and matching releases for its other platforms the same day. The 27.2 advisory does not list CVE-2026-86950, consistent with Apple’s statement that exploitation concerned versions before iOS 27. It does list CVE-2026-86987, an Apple Intelligence authorization issue credited to Richard Hyunho Im of Route Zero Security, whose impact line reads “A remote attacker may be able to access sensitive user data.” The Hacker News noted that Apple did not mention in-the-wild exploitation for any of the 27.2 fixes.

What remains unanswered is the attack itself. Apple’s phrase, “an extremely sophisticated attack against specific targeted individuals,” is all the public record contains, and the Meta Product Security researchers who reported the bug have not described in the sources reviewed what they saw. The conditional wording in Apple’s advisory therefore remains the controlling statement on exploitation, with CISA’s catalogue entry as the stronger signal and the only one that points to confirmed use.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.