Apple has extended the fix for CVE-2026-86950, a CoreGraphics zero-day it said was exploited in an “extremely sophisticated attack against specific targeted individuals”, to older iPhones and iPads. The out-of-bounds write flaw lets a maliciously crafted file lead to arbitrary code execution, and was reported by Meta Product Security. Apple fixed it in September for devices on iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, as covered in our earlier post. Apple’s new advisory, published October 26, applies the same fix to iOS 18.7.11 and iPadOS 18.7.11.
Apple says the known attacks were highly targeted, but BleepingComputer advises installing the backported patches anyway. Apple’s advisory for the 18.7.11 release lists other fixes as well, including an audio information-leak issue and a CoreMedia camera-access issue; this post covers only the CoreGraphics zero-day.
How to check if you’re affected
Affected devices are older models that cannot run the iOS 26 releases, per the advisory’s list: iPhone XS, iPhone XS Max, iPhone XR, and the iPad models Apple lists (iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later, as BleepingComputer reports them). Open Settings → General → Software Update and install iOS 18.7.11 or iPadOS 18.7.11. Newer devices should be on iOS 26.7.1 or later, and Macs on the macOS versions in the earlier post.