Apple released iOS 18.7.11 and iPadOS 18.7.11 on October 26, patching an exploited CoreGraphics zero-day on the iPhone XS, XS Max, XR and several older iPads, about a month after newer devices got the fix.
The Brief
- Apple says CVE-2026-86950, a memory bug in CoreGraphics, lets a maliciously crafted file run arbitrary code.
- Meta Product Security reported the bug, which Apple says may have been used against specific targeted individuals.
- Apple first patched it in September in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
- The iOS 18.7.11 release also fixes 2 app-level flaws, including one that could let a malicious app use the camera.
Older iPhones get the CoreGraphics fix last
The new builds cover the iPhone XS, iPhone XS Max and iPhone XR, plus the iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. Those models sit on the iOS 18 line, so September’s iOS 26.7.1 release never reached them.
That gap matters more than the patch itself. A fix that ships on newer software first can point attackers toward the bug, while older devices wait weeks for their own build.
CoreGraphics handles two-dimensional vector graphics, text drawing and image rendering across iOS, iPadOS, macOS, watchOS and tvOS. Apple’s security advisory says processing a maliciously crafted file may lead to arbitrary code execution.
The flaw is an out-of-bounds write, a bug class where code writes data outside its allocated memory buffer. That can crash programs, corrupt data or hand an attacker code execution, and Apple fixed it with improved bounds checking.
Apple patched an exploited CoreGraphics zero-day (CVE-2026-86950) on the iPhone XS, XS Max, XR and older iPads, about a month after newer devices got the fix. iOS 18.7.11 also closes a bug that let malicious apps reach the camera without permission. Update now! https://t.co/sJvWcabwN6
— SQ Magazine (@sqmagazine_news) October 27, 2026
Apple said the bug “may have been exploited in an extremely sophisticated attack” against specific targeted individuals. Its wording covers versions of iOS before iOS 27, a range that includes the iOS 18 builds these devices run.
The advisory stops there. Apple hasn’t named the targets or the attacker, and it hasn’t said which file format carried the exploit or whether any confirmed attack hit an iPhone XS or XR.
Camera and data-leak bugs ship alongside the zero-day
The update also closes CVE-2026-86990, an access issue that could let a malicious app reach the camera without user permission. Mustafa Calap (@ordinal0, dbg.re) reported it.
A second bug, CVE-2026-65339, is a logic flaw that could let an app leak sensitive user information. Apple credits Calap and Nik Tsytsarkin of Meta Red Team X, and it didn’t flag either issue as exploited.
CVE-2026-86950 is the second exploited zero-day Apple has fixed this year. The first, CVE-2026-20700, sat in dyld (the Dynamic Link Editor Apple’s operating systems use) and was patched in February after being tied to similarly targeted attacks.
Older hardware has drawn attention before in 2026. Apple previously patched older iPhones and iPads against four vulnerabilities used by the Coruna exploit kit in cyberespionage and crypto-theft attacks. It also fixed a Beats Studio Buds flaw, CVE-2025-20701, that let attackers within Bluetooth range spy on conversations.
What’s Next?
For anyone still carrying one of these models, the step is short. Open Settings, then General, then Software Update, and install iOS 18.7.11 or iPadOS 18.7.11, which helps reduce risk from all three flaws. Until then, treat files from unknown senders with extra care, since a crafted file is the exact route Apple describes.
