Apple backports fix for possibly exploited CoreGraphics bug to iOS 18

Apple backports fix for possibly exploited CoreGraphics bug to iOS 18

26 October 2026: Apple has released iOS and iPadOS 18.7.11 to fix CVE-2026-86950, an out-of-bounds write in CoreGraphics that lets a maliciously crafted file run arbitrary code. Apple says it is aware of a report that the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals, on versions of iOS before iOS 27. The update is for older devices: the iPhone XS, XS Max and XR, and several iPad models.

Not yet independently verified. The CVE counts for iOS 27.2 and macOS Sequoia 15.8.2 are our own tallies of the IDs on Apple's pages. We have not seen Apple say more about the targeted attack than its one-line note. We will update this when it can be confirmed, and remove this note.

The same day Apple published fixes across its other platforms, but none of the other pages we read carries an exploitation note.

What iOS 18.7.11 contains

The release fixes three issues. Besides CoreGraphics, CVE-2026-65339 is a logic flaw in Audio that lets an app leak sensitive user information, and CVE-2026-86990 is an access flaw in CoreMedia that lets a malicious app use the camera without permission. Apple credits Meta Product Security for the CoreGraphics report. CVE-2026-86950 does not appear on the iOS 26.7.2 or macOS Sequoia pages, so devices on those lines are not shown as exposed to it.

What the current releases fix

iOS and iPadOS 27.2 carries 163 CVE IDs across 67 components by our count, supported on the iPhone 11 and later. WebKit accounts for the largest group, 26 entries, and the kernel for 15. Two issues allow a remote attacker to break out of the web content sandbox: CVE-2026-112690 in the App Store and CVE-2026-113897 in the WebKit process model. CoreMedia's CVE-2026-112688 allows code execution when a file is parsed.

iOS 26.7.2 lists 134 entries, including WebKit code execution through malicious web content (CVE-2026-112697 and CVE-2026-112659) and a Security component sandbox escape (CVE-2026-65363).

macOS Sequoia 15.8.2 has 197 IDs by our count. CVE-2026-112438 lets an unprivileged attacker execute code as root through the kernel, and CVE-2026-84545 in CUPS lets an app escape the App Sandbox and run code as root. Four entries (CVE-2026-86937, CVE-2026-112568, CVE-2026-84610 and CVE-2026-64789) concern ways to get past Gatekeeper checks.

What an IT team has to do

Check the fleet for devices still on iOS 18. For them 18.7.11 is the update that carries the CoreGraphics fix, and a managed phone left on an earlier 18.7 build still has a flaw Apple says may have been exploited. Mac fleets on Sequoia need 15.8.2, since the macOS entries include root escalation and Gatekeeper bypasses, not only browser fixes.

Teams that run mobile device management can use its update controls and compliance reports to find the stragglers. Our mobile device management category lists 8 products that do this.

Apple's index also shows macOS Golden Gate 27.2, macOS Tahoe 26.7.2, tvOS 27.2, watchOS 27.2, visionOS 27.2 and Safari 27.2 released on 26 October.

Sources

• Apple: About the security content of iOS 18.7.11 and iPadOS 18.7.11, 26 October 2026
• Apple: About the security content of iOS 27.2 and iPadOS 27.2, 26 October 2026
• Apple: About the security content of iOS 26.7.2 and iPadOS 26.7.2, 26 October 2026
• Apple: About the security content of macOS Sequoia 15.8.2, 26 October 2026