Apple patches exploited CoreGraphics zero-day on older iPhones and iPads
Original title: Apple Released Patches for Exploited CoreGraphics 0-day Vulnerability for Older iPhones
iOS and iPadOS 18.7.11 fix CVE-2026-86950, an out-of-bounds write Apple says may have hit specific targets.
On October 26, Apple released iOS 18.7.11 and iPadOS 18.7.11 for older devices, including iPhone XS, XS Max, XR, and the seventh-generation iPad. CVE-2026-86950 is an out-of-bounds write in CoreGraphics that can run code when a crafted file is processed. Apple, crediting Meta Product Security, says it may have been exploited against specific people on iOS before iOS 27. The update also fixes Audio leak CVE-2026-65339 and CoreMedia camera-access CVE-2026-86990, without exploitation warnings.
Unconfirmed: Apple says the flaw may have been exploited; a zero-click or broad campaign is not established.
- Apple fixed CVE-2026-86950 by adding stronger bounds checks.
- iOS 26.7.1 and iPadOS 26.7.1 had already addressed the same CVE.
- CVE-2026-65339 could let an app leak sensitive user information.
- CVE-2026-86990 could let a malicious app access the camera without permission.
- The advisory names no attackers, victims, or file-delivery method.
Impact: code execution when processing a crafted file
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | before iOS 27 on listed older iPhones | iOS 18.7.11 |
| Apple iPadOS | older devices including seventh-generation iPad | iPadOS 18.7.11 |
- 1.Install iOS 18.7.11 or iPadOS 18.7.11 from Settings > General > Software Update.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65339 | A logic issue was addressed with improved checks | 5.0 | <1% | ||
| CVE-2026-86950 | Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS | 8.8 | 26% | KEVPoC ×3 | KEV |
| CVE-2026-86990 | Camera access without permission on Apple devices | — | — |
From the original article
2 min read at cybersecuritynews.com
Apple released iOS 18. 7. 11 and iPadOS 18.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.