Apple brings exploited CoreGraphics fix to iOS 18 devices

Apple extends protection to older iPhones and iPads

Apple has released iOS 18.7.11 and iPadOS 18.7.11 with a fix for CVE-2026-86950, a high-severity CoreGraphics vulnerability carrying a CVSS score of 8.8. The company said the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals using iOS versions before iOS 27.

The update brings the security fix to supported older hardware, including iPhone XS, iPhone XS Max and iPhone XR models. It also covers iPad seventh generation, iPad Air fourth generation and later, iPad ninth generation and later, plus iPad mini sixth generation and later.

Crafted files could trigger code execution

CVE-2026-86950 is an out-of-bounds write in CoreGraphics. Apple said processing a maliciously crafted file could result in arbitrary code execution, making the flaw particularly important for devices that continue to operate on the iOS 18 and iPadOS 18 branches.

Apple initially issued patches last month in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. The backport means organisations with compatible devices that cannot or do not yet run the newer platform releases can receive the CoreGraphics remediation through iOS 18.7.11 and iPadOS 18.7.11.

Two further mobile security fixes

The iOS 18.7.11 and iPadOS 18.7.11 releases include two additional security corrections. CVE-2026-65339 is a logic issue in Audio that a malicious app could exploit to leak sensitive user information.

Apple also fixed CVE-2026-86990, an access vulnerability in CoreMedia. The company said a malicious application could abuse the weakness to access the camera without user permission.

Separately, Apple shipped iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2, visionOS 27.2 and Safari 27.2. Those releases address hundreds of vulnerabilities across components including AppleAVD, CoreAudio, ImageIO, the kernel, Model I/O, Screen Sharing Server, Spotlight, StorageKit and WebKit.

Among the iOS and iPadOS 27.2 fixes is CVE-2026-86987, an authorization issue in Apple Intelligence that could allow a remote attacker to access sensitive user data. Apple said it strengthened entitlement checks to resolve the problem. Apple did not say that this issue or the other vulnerabilities in the 27.2 releases had been exploited in the wild.

Business implication

IT and security teams should inventory eligible iPhone and iPad models, deploy iOS 18.7.11 or iPadOS 18.7.11 through their established update process, and confirm installation on managed devices, with priority given to users who may face targeted threats.