Apple backports CoreGraphics zero-day fix to older iPhones

Apple released iOS 18.7.11 and iPadOS 18.7.11 on 26 October 2026, backporting the fix for CVE-2026-86950 to devices that cannot run iOS 26 or later. The updates cover iPhone XR, iPhone XS Max, iPhone XS, the seventh-generation iPad, iPad Air 4th generation and later releases, iPad 9th generation and later releases, and iPad mini 6th generation and later releases. CoreGraphics, Apple's framework for graphics and image rendering, contains an out-of-bounds write weakness. According to Apple, opening a maliciously crafted file could allow arbitrary code execution.

The first fixes arrived on 28 September for iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. Apple said in its security notes that it had been told the issue "may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27". Apple has not named victims, attributed the attacks, or explained how malicious files were delivered. Meta Product Security reported the flaw.

On 29 September, the US Cybersecurity and Infrastructure Security Agency placed CVE-2026-86950 on its Known Exploited Vulnerabilities list, with a remediation deadline of 13 October for federal civilian agencies; ransomware use is listed as unknown. NVD shows a CISA CVSS 3.1 score of 8.8, while Apple does not publish CVSS scores. CISA's SSVC evaluation classifies exploitation as active and says the vulnerability cannot be automated.

The same iOS 18.7.11 and iPadOS 18.7.11 updates also fix CVE-2026-65339, which could let an app access sensitive user information, and CVE-2026-86990, which could let a malicious app use the camera without permission. Apple has not indicated either was exploited. Apple has also issued more updates for newer hardware, such as iOS 27.2, iPadOS 27.2, and macOS Golden Gate 27.2, covering many flaws. Apple's notifications do not include watchOS, tvOS, or visionOS for this CVE.

BleepingComputer reported that this is the second zero-day Apple has fixed in 2026; the first, CVE-2026-20700 in dyld, was patched in February.

For defenders, Apple has published no workaround; the update is the fix. Use MDM to list devices still below iOS or iPadOS 18.7.11 and push the update, and consider minimum OS version policies for personal devices that access work data. No indicators of compromise have been published by Apple, CISA or NVD.