Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
Apple has expanded security patches for a high-severity vulnerability to older iPhones and iPads after confirming it was exploited in real-world attacks.
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file.
Expanded Coverage
Patches for the flaw were originally released last month with iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. The fixes have now been expanded to include iOS 18.7.11 and iPadOS 18.7.11, supporting iPhone XS, iPhone XS Max, iPhone XR, and various iPad models.
Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
Additional Vulnerabilities
The iOS 18.7.11 and iPadOS 18.7.11 updates also address a logic issue in Audio (CVE-2026-65339) that could leak sensitive user information and an access vulnerability in CoreMedia (CVE-2026-86990) that could allow malicious apps to access the camera without permission.
Meanwhile, Apple shipped iOS 27.2, iPadOS 27.2, and other operating system updates, fixing hundreds of vulnerabilities including an authorization issue in Apple Intelligence (CVE-2026-86987) that could allow remote attackers to access sensitive user data.
Related
