Apple backports fix for exploited CoreGraphics flaw to older iPhones and iPads
Original title: Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
iOS 18.7.11 and iPadOS 18.7.11 also fix an Audio data leak and unauthorized camera access.
Apple backported patches for CVE-2026-86950, an out-of-bounds write in CoreGraphics (CVSS 8.8) that can run arbitrary code when a crafted file is processed. Fixes first shipped last month in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 now also cover iOS 18.7.11 and iPadOS 18.7.11. Apple says a report indicates exploitation in highly targeted attacks on iOS before iOS 27. The same older-OS releases fix CVE-2026-65339 and CVE-2026-86990; a separate 27.2 wave fixes hundreds more issues, including CVE-2026-86987 in Apple Intelligence.
Unconfirmed: Apple cites a report that CVE-2026-86950 may have been exploited against specific individuals, and does not say the other listed flaws were exploited.
- CVE-2026-86950 is an out-of-bounds write scored CVSS 8.8.
- Supported older hardware includes iPhone XS, XR, and listed iPad models.
- CVE-2026-65339 is a logic bug that can leak user information.
- CVE-2026-86990 can let a malicious app use the camera without permission.
- CVE-2026-86987 is an Apple Intelligence authorization issue fixed with entitlement checks.
Impact: Arbitrary code execution when processing a crafted file
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | iOS before iOS 27; older devices on the iOS 18 line | iOS 26.7.1; iOS 18.7.11 |
| Apple iPadOS | — | iPadOS 26.7.1; iPadOS 18.7.11 |
| Apple macOS Tahoe | — | 26.7.1 |
| Apple macOS Sequoia | — | 15.8.1 |
- 1.Install iOS 18.7.11 or iPadOS 18.7.11 on supported older iPhones and iPads.
- 2.Update current Apple devices to the 27.2 releases, including Safari 27.2.
- Vendors
- Apple
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65339 | A logic issue was addressed with improved checks | 5.0 | <1% | ||
| CVE-2026-86950 | Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS | 8.8 | 26% | KEVPoC ×3 | KEV |
| CVE-2026-86987 | Authorization flaw in iOS and iPadOS before 27.2 | 5.5 | — | ||
| CVE-2026-86990 | Camera access without permission on Apple devices | — | — |
From the original article
2 min read at thehackernews.com
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8. 8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.