Apple Brings Its Exploited CoreGraphics Fix to Older iPhones
iOS and iPadOS 18.7.11 backport Apple's fix for CVE-2026-86950, a CoreGraphics zero-day Apple says may have been exploited against targeted individuals, to the iPhone XS, XR and older iPads.
Apple has pushed its fix for an exploited CoreGraphics zero-day down to iPhones and iPads that can’t run the current iOS. iOS 18.7.11 and iPadOS 18.7.11, released Oct. 26, patch CVE-2026-86950, a bug Apple says may have been used in an “extremely sophisticated attack” against specific people. The flaw was first fixed in iOS 26.7.1 in September, and BleepingComputer reports this release brings the same protection to older hardware.
For defenders
The bug: CVE-2026-86950 is an out-of-bounds write (CWE-787) in CoreGraphics, the framework iOS uses to draw text, vector graphics and images. Apple says processing a maliciously crafted file may lead to arbitrary code execution, and that it fixed the issue with better bounds checking. Meta Product Security reported it. NVD lists a CVSS score of 8.8. CISA added it to its Known Exploited Vulnerabilities catalog on Sept. 29, and public proof-of-concept code is reported in seven GitHub repositories.
Exploitation: Apple says it’s aware of a report that the flaw may have been exploited against targeted individuals on versions before iOS 27. That’s Apple’s usual wording for spyware-grade attacks; it hasn’t named an actor or victims.
Who needs 18.7.11: iPhone XS, XS Max and XR; iPad 7th generation; iPad Air 4th generation and later; iPad 9th generation and later; iPad mini 6th generation and later. The release also fixes CVE-2026-65339 (Audio, an app may leak sensitive user data) and CVE-2026-86990 (CoreMedia, a malicious app may reach the camera without permission). Apple doesn’t say either of those was exploited.
Fleet check: Devices that can run iOS 26 should already be on 26.7.1 or later. Use your MDM to flag anything older still sitting below 18.7.11.
What it means for you
If you or someone in your family still uses an older iPhone, such as an XS or XR, this is the update that closes a hole attackers have actually used. These attacks so far have been aimed at a small number of chosen targets, not everyone, but once a fix ships, the details tend to spread. Newer iPhones got the same fix last month in iOS 26.7.1.
Do this now
- On an older iPhone or iPad, go to Settings > General > Software Update and install iOS or iPadOS 18.7.11.
- On a newer device, confirm you’re on iOS 26.7.1 or later, and turn on Automatic Updates while you’re there.
- If you’re at higher risk of targeted spying (journalists, activists, executives), consider turning on Lockdown Mode under Settings > Privacy & Security.
CVE at a glance
- CVSS
- 8.8 High (v3.1)
- EPSS
- 26.2% chance of exploitation in the next 30 days (higher than 97.9% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Sep 29, 2026
- Public exploit
- Yes, reported in 7 GitHub repositories
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.