CVE-2026-86950: Apple backports exploited CoreGraphics fix in iOS 18.7.11 for iPhone XS, XR

Apple has released iOS 18.7.11 and iPadOS 18.7.11, bringing a fix for CVE-2026-86950 to older iPhones and iPads that cannot run the iOS 26 or iOS 27 releases. The flaw is a CoreGraphics out-of-bounds write that Apple says may have been used in "an extremely sophisticated attack against specific targeted individuals". The fix first shipped for newer devices on 28 September; the 26 October update closes the gap for the iPhone XS, XS Max, XR and several iPad models.

Key points

• CVE-2026-86950 is an out-of-bounds write in CoreGraphics; processing a malicious file can lead to arbitrary code execution, according to Apple's advisory.
• Apple says it may have been exploited in a highly sophisticated attack against specific targeted individuals on iOS versions before iOS 27. Apple has not said who was targeted or how.
• iOS 18.7.11 and iPadOS 18.7.11 (26 October 2026) cover iPhone XS, iPhone XS Max, iPhone XR and several iPad generations; the same update also fixes CVE-2026-65339 (Audio) and CVE-2026-86990 (CoreMedia).
• Newer devices got the fix on 28 September in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
• Researchers at Calif published a proof of concept on GitHub around 1 October; the reporting says it triggers a crash, not code execution.

What to do

1. Check your device. On an iPhone XS, XS Max or XR, or one of the iPads listed below, open Settings > General > Software Update and install iOS 18.7.11 or iPadOS 18.7.11. Apple lists these devices for the 18.7.11 update: iPhone XS, iPhone XS Max, iPhone XR, iPad (7th generation), iPad Air (4th generation and later), iPad (9th generation and later) and iPad mini (6th generation and later). The device list on Apple's page is missing separators, so check the advisory for your exact model.
2. Newer devices should be on iOS 26.7.1 or later (Bitdefender says 26.7.1 covers iPhone 11 and later and supported iPads); Apple's current releases are listed as 27.0.1. On a Mac, install macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1 or later via System Settings > General > Software Update.
3. Turn on automatic updates, and keep browsers and messaging apps current, since Apple describes the trigger only as a "maliciously crafted file".
4. If you face elevated risk of targeted spyware (journalists, activists, officials), Bitdefender suggests considering Lockdown Mode.
5. To check whether you are affected: Settings > General > About shows the installed version. Anything older than the versions above is unpatched for this bug. We found no published indicator of compromise, and Apple has not released one.

What happened

Apple's security notice for iOS 18.7.11 and iPadOS 18.7.11 is dated 26 October 2026. It lists three fixes. The headline entry is CVE-2026-86950 in CoreGraphics, Apple's framework for 2D drawing, text and image rendering. The impact line reads: "Processing a maliciously crafted file may lead to arbitrary code execution." Apple describes the cause as an out-of-bounds write, fixed with improved bounds checking, and credits Meta Product Security with the discovery.

Apple also states it is aware of a report that the issue may have been used in a highly sophisticated attack against specific targeted individuals on iOS versions before iOS 27. The company gives no detail on the victims, the delivery method or the number of devices involved, and it has not said whether spyware was used or whether the attack needed any interaction. Bitdefender notes that Apple has not indicated the flaw is zero-click.

The same update fixes two other issues. CVE-2026-65339 in Audio could let an app leak sensitive user information; Apple fixed a logic issue with improved checks and credits Mustafa Calap and Meta Red Team X. CVE-2026-86990 in CoreMedia could let a malicious app access the camera without the user's permission; Apple credits Mustafa Calap. Apple does not mark either as exploited.

BleepingComputer, which reported the backport on 27 October, describes it as extending patches that Apple first made in September to older devices. Its article gives the main-branch fix as iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.

Background

The September fix came on 28 September, according to Bitdefender, in the 26.7.1 releases. The vulnerability then became public knowledge in a way that matters for risk: Security Affairs reported on 1 October that researchers at Calif had published a proof of concept on GitHub as part of a write-up titled "The Great Glyph Grift". Per that report, the code triggers the bug with a PDF that contains a crafted embedded font and causes a crash on macOS and iOS. Security Affairs, citing The Hacker News, says the code "causes a crash, not an execution error", and that turning the memory corruption into a working exploit is not demonstrated. We would still treat a public trigger as a reason to patch promptly, because it tells attackers exactly where to look.

Apple has patched several zero-days this year. BleepingComputer recalls CVE-2026-20700, a code-execution flaw in dyld used in targeted attacks and patched in February, and a set of fixes for older devices against four vulnerabilities used in the Coruna exploit kit. Our coverage of the previous point release is in iOS 27.2 released: Siri AI adds five languages.

How it works

CoreGraphics (also called Quartz 2D) is the layer that turns drawing instructions, fonts and images into pixels, and it sits underneath almost every app that shows a document, a photo or a message preview. An out-of-bounds write means code writes data past the end of a memory buffer, which can corrupt neighbouring data and, in the worst case, let an attacker steer execution. Because the vulnerable code parses files, the trigger is a crafted file, which is what Apple's text describes. The public proof of concept uses a PDF with a crafted font, which suggests the font-handling path is involved, but Apple has not said which code path the in-the-wild attack used.

What it means

For users of the iPhone XS, XS Max and XR, this is the first fix for a bug Apple believes was exploited. These phones receive the iOS 18.7.x line rather than iOS 26 or 27. The gap is visible in the dates: devices on iOS 26 got the fix on 28 September, these devices on 26 October, about four weeks later according to Apple and Bitdefender. During that window the bug was fixed for some people and a proof-of-concept trigger was public, while older models remained exposed. Targeted attacks like this one usually go after a handful of people, so most owners face low odds, but those odds are not zero for people in at-risk groups.

For organisations, the practical task is inventory: mobile device management reports should flag any iPhone XS, XS Max, XR or listed iPad still below 18.7.11, along with devices on older 26.x builds. For developers, the episode is a reminder of how much code parses untrusted files by default, and why memory-safe parsing and sandboxed rendering matter.

What we don't know yet

• Who was targeted, by whom, and how the file was delivered.
• Whether the in-the-wild exploit needed any user action.
• Whether the exploit chain used other bugs; Apple lists no related CVEs as exploited.
• Whether Apple will backport the fix further to other older models; this article covers only the devices Apple names.
• The CVSS score; none of the sources we read states one.

What to watch next

Watch for a working public exploit built on the Calif trigger, for follow-up advisories from Apple, and for any threat-intelligence report (from Meta or others) describing the attack. Apple's security releases page is the authoritative place to check.

Sources

• Apple security notice for iOS 18.7.11 and iPadOS 18.7.11 (primary)
• BleepingComputer: Apple backports CoreGraphics zero-day patches to older iPhones
• Bitdefender: Apple patches zero-day behind "extremely sophisticated" iPhone attacks
• Security Affairs: Public PoC released for Apple CoreGraphics zero-day CVE-2026-86950