● Covered by 2 sources · 2 reportsMedium impact2 neutral
Apple Backports CoreGraphics Zero-Day Fix to Older iPhones and iPads
Key points
- Apple released iOS 18.7.11 and iPadOS 18.7.11.
- Patches address CoreGraphics zero-day CVE-2026-86950.
- Vulnerability was exploited in targeted attacks.
- Fixes extend to older devices like iPhone XS and iPad 7th generation.
- An out-of-bounds write could allow arbitrary code execution.
Critical Security Update for Older Apple Devices
Apple has issued security patches for older iPhone and iPad models, specifically iOS 18.7.11 and iPadOS 18.7.11. These updates address a critical zero-day vulnerability, tracked as CVE-2026-86950, which was actively exploited in targeted attacks against specific individuals.
The patches extend protection to devices such as iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
CoreGraphics Vulnerability Details
The vulnerability, an out-of-bounds write issue in CoreGraphics, could allow attackers to execute arbitrary code by processing a maliciously crafted file. CoreGraphics is a framework responsible for two-dimensional vector graphics, text drawing, and image rendering across Apple's operating systems.
Meta Product Security discovered this weakness. Successful exploitation of out-of-bounds write issues can result in program crashes, data corruption, or remote code execution.
Prior Patches and Exploitation
Apple previously patched this same vulnerability in September for devices running iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. The company acknowledged that the issue may have been exploited in "extremely sophisticated" attacks on versions of iOS prior to iOS 27.
The recent backported fixes ensure that a wider range of Apple devices, including those not covered by the initial September updates, are now protected from this actively exploited flaw.
Additional Fixes
In addition to the CoreGraphics fix, iOS 18.7.11 and iPadOS 18.7.11 also address a logic issue in Audio (CVE-2026-65339). This audio vulnerability could potentially be exploited by an application to leak sensitive user information.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
CVE CVE-2026-869508.8 HIGH CVE CVE-2026-207007.8 HIGH CVE CVE-2025-207018.8 HIGH CVE CVE-2026-653395.0 MEDIUM CVE CVE-2026-86990 CVE CVE-2026-86987How outlets covered it
Apple released iOS 18.7.11 and iPadOS 18.7.11 to address a CoreGraphics vulnerability (CVE-2026-86950) that was exploited in real-world attacks. This update extends protection to older devices, ensuring critical security patches reach a wider user base.
Apple released security patches for older iPhone and iPad models to address a CoreGraphics zero-day vulnerability (CVE-2026-86950) that was actively exploited in targeted attacks. This patch extends protection to devices not covered by the initial September update, preventing arbitrary code execution via maliciously crafted files.