Apple’s iOS 18.7.11 fixes exploited CoreGraphics flaw
October 27: Cyber Security News identifies CVE-2026-86950 as an exploited CoreGraphics flaw fixed in iOS and iPadOS 18.7.11, plus two other CVEs.
Apple’s October 26 iOS and iPadOS 18.7.11 update fixes a CoreGraphics flaw Apple says may have been exploited.
On October 26, 2026, Apple released iOS and iPadOS 18.7.11, 26.7.2, and 27.2. Cyber Security News reports that 18.7.11 fixes CVE-2026-86950, an out-of-bounds write in CoreGraphics that can run code when a crafted file is processed. Apple, crediting Meta Product Security, says it may have been exploited against specific people on iOS versions before iOS 27. The same update also fixes Audio information-leak CVE-2026-65339 and CoreMedia camera-access CVE-2026-86990, without exploitation warnings. Separate notices for 26.7.2 and 27.2 name Accelerate Framework updates for newer iPhones and iPad Pros but give no flaw details.
- CVE-2026-86950 is a CoreGraphics out-of-bounds write fixed with stronger bounds checks.
- Apple says it may have been exploited against specific people before iOS 27.
- iOS 26.7.1 and iPadOS 26.7.1 had already addressed CVE-2026-86950.
- 18.7.11 also fixes CVE-2026-65339 and CVE-2026-86990, with no exploitation warnings.
- Advisories for 26.7.2 and 27.2 name Accelerate updates for iPhone 11 and later.
- Listed builds are 22H384, 23H128, and 24B119.
Timeline
dated events in the reporting · oldest first- Oct 26, 2026Apple releases iPadOS 18.7.11, 26.7.2, and 27.2. · Apple software releases
- Oct 27, 2026Full Disclosure posts three Apple security notices. · Full Disclosure
- Oct 27, 2026Report says 18.7.11 fixes exploited CoreGraphics CVE-2026-86950. · Cyber Security News
What each outlet adds
beyond the shared facts- Apple software releasesLists builds 22H384, 23H128, and 24B119 without CVE details.
- Full DisclosureNames advisory IDs, Accelerate and Audio, and device ranges.
- Cyber Security NewsIdentifies three CVEs and possible exploitation of CVE-2026-86950.
Coverage
oldest first · one row per article · UTC- · 4d ago
Apple software releasesFirst report
Apple lists iPadOS 18.7.11 build 22H384
Only download and release-note links are shown; no flaws or fixes are named.
- · 4d ago
Apple publishes iPadOS 26.7.2 (23H128)
Build 23H128 is listed without any stated vulnerabilities, fixes, or exploitation.
- · 4d ago
Apple releases iPadOS 27.2 (24B119)
The listing only points to downloads and release notes, with no security fixes described.
- · 3d ago
Full Disclosure
Apple issues iOS 27.2 and iPadOS 27.2 security update
The notice names the Accelerate Framework for iPhone 11 and later and newer iPad Pro models.
- · 3d ago
Apple issues iOS 26.7.2 and iPadOS 26.7.2 security update
The notice names the Accelerate Framework and starts the device list at iPhone 11 and later.
- · 3d ago
Apple issues iOS 18.7.11 and iPadOS 18.7.11 security update
The notice names the Audio component and lists older iPhone and iPad models that receive the update.
- · 3d ago
Cyber Security News
Apple patches exploited CoreGraphics zero-day on older iPhones and iPads
iOS and iPadOS 18.7.11 fix CVE-2026-86950, an out-of-bounds write Apple says may have hit specific targets.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65339 | A logic issue was addressed with improved checks | 5.0 | <1% | ||
| CVE-2026-86950 | Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS | 8.8 | 26% | KEVPoC ×3 | KEV |
| CVE-2026-86990 | Camera access without permission on Apple devices | — | — |