Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
Our summary
Apple has extended patches for an actively exploited CoreGraphics vulnerability to older devices that originally received fixes only in last month's updates. The flaw, CVE-2026-86950 (CVSS 8.8), is an out-of-bounds write in CoreGraphics that can lead to arbitrary code execution through a malicious file, and Apple says it may have been used in highly targeted attacks against specific individuals running iOS versions before iOS 27. The company first patched the bug in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, and has now released iOS 18.7.11 and iPadOS 18.7.11 covering devices like the iPhone XS, XS Max, XR, and several iPad models. These updates also fix an Audio data-leak bug (CVE-2026-65339) and a CoreMedia flaw (CVE-2026-86990) allowing unauthorized camera access, alongside the separately released iOS 27.2 and related OS updates that close hundreds of additional bugs, including an Apple Intelligence authorization issue (CVE-2026-86987).
The Hacker News publishes this story on its own site; we link to it rather than reprint it.
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.