Apple Backports Fix for Exploited CoreGraphics Zero-Day CVE-2026-86950 to Older iPhones

TL;DR

On October 26, 2026, Apple released iOS 18.7.11 and iPadOS 18.7.11 to fix CVE-2026-86950, an exploited CoreGraphics zero-day. Apple says the flaw “may have been exploited” against “specific targeted individuals.” The update brings the fix to older iPhones and iPads that cannot run newer iOS versions.

Why It Matters

This CoreGraphics zero-day is already confirmed as exploited. CISA added it to its Known Exploited Vulnerabilities catalog on September 29, 2026. At that point, Apple had patched iOS 26.7.1 and macOS, but not the iOS 18 branch.

As a result, owners of devices such as the iPhone XS and iPhone XR waited about a month for protection.

How the Attack Works

According to the Apple security content for iOS 18.7.11, “processing a maliciously crafted file may lead to arbitrary code execution.” The root cause is “an out-of-bounds write issue.” Meta Product Security reported the flaw.

The CVE record scores it CVSS 8.8. Apple ties the attacks to “versions of iOS before iOS 27.” According to the CVE record, the same fix also shipped in iPadOS 26.7.1, macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1.

Two other fixes

• CVE-2026-65339 (Audio): An app may be able to leak sensitive user information.
• CVE-2026-86990 (CoreMedia): A malicious app may be able to access the camera without user permission.

Researcher Mustafa Calap of dbg.re reported both bugs, with Meta Red Team X also credited on the Audio flaw. Apple does not report exploitation of these two bugs.

Affected Devices

The update covers the iPhone XS, XS Max and XR. It also covers iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.

Patch and Mitigation Steps

• Install iOS 18.7.11 or iPadOS 18.7.11 through Settings.
• Move newer devices to iOS 26.7.1 or later.
• Avoid opening untrusted image or document files until patched.

Because attackers already use this CoreGraphics zero-day, update older devices today.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.