Apple backports exploited CoreGraphics fix to iOS 18.7.11
October 29: Malwarebytes says Apple advises high-risk users to restart and consider Lockdown Mode, and notes tvOS 26.6.1 lists no published CVEs.
Apple’s October 26 updates backport the CVE-2026-86950 CoreGraphics fix to older iPhones and iPads after reported targeted attacks.
Apple on October 26 backported last month’s fix for CVE-2026-86950, an out-of-bounds write in CoreGraphics reported by Meta Product Security, in iOS and iPadOS 18.7.11 for iPhone XS, XS Max, XR, and listed older iPads. Processing a maliciously crafted file may lead to arbitrary code execution. SecurityWeek reports Apple said the bug was exploited in an extremely sophisticated attack; BleepingComputer, GBHackers, The Hacker News, and Malwarebytes say Apple is aware of a report that it may have been exploited against specific people on iOS before iOS 27. September patches covered iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1; SecurityWeek says iOS and macOS 27 are not affected. The 18.7.11 releases also fix CVE-2026-65339 and CVE-2026-86990, which are not described as exploited.
- CVE-2026-86950 is an out-of-bounds write; The Hacker News cites CVSS 8.8.
- iOS and iPadOS 18.7.11 also fix Audio leak CVE-2026-65339 and camera flaw CVE-2026-86990.
- First fixes shipped in iOS 26.7.1, iPadOS 26.7.1, Tahoe 26.7.1, and Sequoia 15.8.1.
- SecurityWeek counts 286 flaws across the newest iOS and macOS updates.
- Malwarebytes says Apple suggests high-risk users restart and consider Lockdown Mode.
Timeline
dated events in the reporting · oldest first- Oct 26, 2026Apple releases iOS and iPadOS 18.7.11 and broader OS updates · GBHackers
- Oct 28, 2026Canadian Centre issues Apple advisory AV26-1099 · Canadian Centre for Cyber Security
What each outlet adds
beyond the shared facts- SecurityWeekSays the bug was exploited and iOS and macOS 27 are unaffected
- GBHackersCredits Mustafa Calap and Meta Red Team X on the extra flaws
- The Hacker NewsScores CVE-2026-86950 at CVSS 8.8 and notes CVE-2026-86987
- Canadian Centre for Cyber SecurityAdvisory AV26-1099 lists affected builds before the stated releases
- Malwarebytes LabsHigh-risk users should restart and consider Lockdown Mode
Coverage
oldest first · one row per article · UTC- · 3d ago
BleepingComputerFirst report
Apple backports CoreGraphics zero-day patches to older iPhones
CVE-2026-86950, an out-of-bounds write, may have been used in targeted attacks on iOS before iOS 27.
- · 3d ago
GBHackers
Apple fixes exploited CoreGraphics zero-day in iOS 18.7.11
CVE-2026-86950 is an out-of-bounds write triggered by a crafted file; two other flaws can leak data or open the camera.
- · 3d ago
SecurityWeek
Apple patches 286 iOS and macOS bugs, backports exploited flaw
iOS and iPadOS 18.7.11 carry the CVE-2026-86950 fix; Apple says iOS and macOS 27 are not affected.
- · 3d ago
The Hacker News
Apple backports fix for exploited CoreGraphics flaw to older iPhones and iPads
iOS 18.7.11 and iPadOS 18.7.11 also fix an Audio data leak and unauthorized camera access.
- · 2d ago
Canadian Centre for Cyber Security
Apple advisory AV26-1099 lists flaws in iOS, macOS, Safari and more
Affected builds are those before the stated iOS, iPadOS, macOS, visionOS, tvOS, watchOS and Safari releases.
- · 1d ago
Malwarebytes Labs
Apple fixes CoreGraphics flaw CVE-2026-86950 on older iPhones and iPads
Apple says the out-of-bounds write may have been used in targeted attacks on iOS before iOS 27; iOS 18.7.11 backports the fix.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65339 | A logic issue was addressed with improved checks | 5.0 | <1% | ||
| CVE-2026-86950 | Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS | 8.8 | 26% | KEVPoC ×3 | KEV |
| CVE-2026-86987 | Authorization flaw in iOS and iPadOS before 27.2 | 5.5 | — | ||
| CVE-2026-86990 | Camera access without permission on Apple devices | — | — |