Apple fixes exploited CoreGraphics zero-day in iOS 18.7.11
CVE-2026-86950 is an out-of-bounds write triggered by a crafted file; two other flaws can leak data or open the camera.
82
Vulnerability1 · 1 read
CVE-2026-65339
- CVSS 3.1
- 5.0 medium
- EPSS
- <1%p3
- Published
- ·
- Modified
Description · NVD
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to leak sensitive user information.
- Vendors
- apple
- Products
- ipados, iphone os, macos
- Weakness
- CWE-693
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
In the news
3 storiesApple patches exploited CoreGraphics zero-day on older iPhones and iPads
iOS and iPadOS 18.7.11 fix CVE-2026-86950, an out-of-bounds write Apple says may have hit specific targets.
78
Apple backports fix for exploited CoreGraphics flaw to older iPhones and iPads
iOS 18.7.11 and iPadOS 18.7.11 also fix an Audio data leak and unauthorized camera access.
76