Apple Fixes Actively Exploited iOS Zero-Day Vulnerability in CoreGraphics - GBHackers News
Apple has released updates for iOS 18.7.11 and iPadOS 18.7.11 to address three security vulnerabilities, including a CoreGraphics flaw connected to sophisticated targeted attacks.
These updates were released on October 26, 2026, and also resolve information disclosure and unauthorized camera access issues affecting the Audio and CoreMedia components. The most significant vulnerability, tracked as CVE-2026-86950, could allow arbitrary code execution when a device processes a maliciously crafted file. Apple credited Meta Product Security for reporting this issue.
CoreGraphics Flaw Exploited
According to the security advisory, the CoreGraphics vulnerability stems from an out-of-bounds write, a memory corruption condition that modifies memory beyond its designated boundary. Apple addressed this issue by implementing improved bounds checking.
Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27
This wording indicates that there have been reports of exploitation against selected victims rather than evidence of indiscriminate attacks. However, Apple has not disclosed the attackers' identities, the number of affected individuals, or the timeline of the reported activity.
The advisory indicates that malicious file processing is the trigger but does not specify the file format, delivery mechanism, or whether exploitation requires user interaction. It also does not clarify if this flaw was combined with other vulnerabilities.
Additional Vulnerabilities
The updates also address two additional vulnerabilities. CVE-2026-65339 affects the Audio component, where a logic issue could let an application leak sensitive user information. Apple credited Mustafa Calap and Nik Tsytsarkin from Meta Red Team X for reporting this flaw.
The third vulnerability, CVE-2026-86990, affects CoreMedia and could let a malicious application access the camera without user permission. Apple resolved this access-control issue by tightening restrictions and credited Mustafa Calap with its discovery.
Affected Devices
Apple's security releases page lists iOS 18.7.11 and iPadOS 18.7.11 for the following devices: iPhone XS, iPhone XS Max, iPhone XR, and seventh-generation iPad. Users and administrators managing these devices should prioritize installing the applicable updates, especially given Apple's acknowledgment of reported exploitation.
Related
