Apple fixes exploited CoreGraphics zero-day in iOS 18.7.11
Original title: Apple Fixes Actively Exploited iOS Zero-Day Vulnerability in CoreGraphics
CVE-2026-86950 is an out-of-bounds write triggered by a crafted file; two other flaws can leak data or open the camera.
Apple released iOS 18.7.11 and iPadOS 18.7.11 on October 26, 2026, fixing three flaws. CVE-2026-86950, an out-of-bounds write in CoreGraphics reported by Meta Product Security, can run arbitrary code when a device processes a maliciously crafted file. Apple says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific people on iOS before iOS 27. CVE-2026-65339 in Audio can leak sensitive information, and CVE-2026-86990 in CoreMedia can let an app use the camera without permission. The release covers iPhone XS, XS Max, XR, and seventh-generation iPad.
Unconfirmed: Apple cites a report of possible targeted exploitation and does not identify attackers, victim count, or timing.
- Apple improved bounds checking for the CoreGraphics out-of-bounds write.
- The advisory does not name the file format, delivery method, or whether a click is required.
- Audio and CoreMedia advisories do not mention in-the-wild exploitation or CVSS scores.
- Mustafa Calap is credited on the Audio and CoreMedia issues; Meta Red Team X also reported Audio.
- The advisory does not describe cleanup for devices that may already be compromised.
Impact: Arbitrary code execution when a crafted file is processed
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | versions of iOS before iOS 27 | iOS 18.7.11 |
| Apple iPadOS | — | iPadOS 18.7.11 |
- 1.Install iOS 18.7.11 or iPadOS 18.7.11 on listed iPhone and iPad models.
- 2.Prioritize patching rather than blocking assumed file types, which Apple does not name.
- Vendors
- Apple
- Products
- iOSiPadOSCoreGraphics
- Organizations
- Meta Product Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65339 | A logic issue was addressed with improved checks | 5.0 | <1% | ||
| CVE-2026-86950 | Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS | 8.8 | 26% | KEVPoC ×3 | KEV |
| CVE-2026-86990 | Camera access without permission on Apple devices | — | — |
From the original article
2 min read at gbhackers.com
Apple has released updates for iOS 18. 7. 11 and iPadOS 18.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.