Apple backports fix for exploited CoreGraphics flaw to older iPhones and iPads
iOS 18.7.11 and iPadOS 18.7.11 also fix an Audio data leak and unauthorized camera access.
76
Vulnerability1 · 1 read
CVE-2026-86987
Authorization flaw in iOS and iPadOS before 27.2
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An authorization weakness in iOS and iPadOS allowed a remote attacker to reach sensitive user data. Apple fixed it with stronger entitlement checks in iOS 27.2 and iPadOS 27.2. Devices still running earlier releases are affected.
What to do: Update iPhones to iOS 27.2 and iPads to iPadOS 27.2.
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | before 27.2 | 27.2 |
| Apple iPadOS | before 27.2 | 27.2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An authorization issue was addressed with improved entitlement checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. A remote attacker may be able to access sensitive user data.
- Vendors
- apple
- Products
- ipados, iphone os
- Weakness
- CWE-862
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
In the news
2 storiesApple iOS 27.2 fixes 163 flaws, including critical WebKit RCE
The release addresses memory corruption, sandbox escape, kernel writes, and unauthorized access to sensitive user data across many components.
74