Apple fixes CoreGraphics flaw CVE-2026-86950 on older iPhones and iPads
Original title: Have an older iPhone or iPad? Apple has a security update for you
Apple says the out-of-bounds write may have been used in targeted attacks on iOS before iOS 27; iOS 18.7.11 backports the fix.
Apple released security updates on October 26, including a backport of a CoreGraphics fix for iPhones and iPads that cannot run iOS 26. CVE-2026-86950 is an out-of-bounds write; processing a maliciously crafted file may lead to arbitrary code execution. Apple said it knows of a report that the flaw may have been exploited in an extremely sophisticated attack on specific people using iOS before iOS 27. Apple first fixed the flaw in iOS 26.7.1.
Unconfirmed: Apple cites a report that exploitation may have occurred; victims and the attack tool are not named.
- iOS 18.7.11 and iPadOS 18.7.11 cover iPhone XS, XS Max, XR, and 7th-generation iPad.
- Apple first fixed the CoreGraphics flaw in iOS 26.7.1.
- The listed tvOS 26.6.1 update has no published CVE entries.
- Apple suggests high-risk users restart and consider Lockdown Mode.
Impact: Arbitrary code execution via a maliciously crafted file
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | versions of iOS before iOS 27 | iOS 26.7.1; iOS 18.7.11 |
| Apple iPadOS | — | iPadOS 18.7.11 |
| Apple CoreGraphics | — | — |
- 1.Install iOS 18.7.11 or iPadOS 18.7.11 on older supported iPhones and iPads.
- 2.Check Settings > General > Software Update and install the available update.
- 3.If you may be a spyware target, restart and consider Lockdown Mode.
- CVEs
- CVE-2026-86950
- Vendors
- Apple
- Products
- iOSiPadOSCoreGraphics
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86950 | Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS | 8.8 | 26% | KEVPoC ×3 | KEV |
From the original article
3 min read at malwarebytes.com
Apple has backported a fix for a CoreGraphics flaw reportedly exploited in targeted attacks to the iPhone XS, XS Max and XR, and seventh-generation iPad.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.