Older iPhones and iPads Get Patch for CoreGraphics Zero-Day Used in Targeted Attacks

On Monday, Apple released updates that bring a fix for an actively exploited CoreGraphics vulnerability, CVE-2026-86950, to older iPhones and iPads. The company had already patched the flaw on its current platforms last month. Apple says the bug may have been used in an "extremely sophisticated attack against specific targeted individuals". The new iOS 18.7.11 and iPadOS 18.7.11 releases now cover devices that cannot run the latest software. BleepingComputer reports that Meta Product Security discovered the flaw.

What happened

The timeline, based on reporting from BleepingComputer and The Hacker News, runs as follows:

1. September: Apple fixed CVE-2026-86950 in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. In its advisory, Apple said it was aware of a report that the issue may have been exploited against devices running versions of iOS earlier than iOS 27.
2. This Monday: Apple published iOS 18.7.11 and iPadOS 18.7.11. These releases backport the same CoreGraphics fix to older hardware. "Backporting" means taking a fix built for newer software and applying it to an older version that is still supported.
3. Same release cycle: Apple also shipped iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2, visionOS 27.2 and Safari 27.2. According to The Hacker News, these updates fix hundreds of vulnerabilities across components including AppleAVD, CoreAudio, ImageIO, the kernel, Model I/O, Screen Sharing Server, Spotlight, StorageKit and WebKit.

The 18.7.11 updates also fix two other bugs, as reported by The Hacker News:

• CVE-2026-65339, a logic flaw in the Audio component that an app could abuse to leak sensitive user information.
• CVE-2026-86990, an access issue in CoreMedia that a malicious app could use to reach the camera without the user's permission.

Among the 27.2 fixes, The Hacker News highlighted CVE-2026-86987, an authorization flaw in Apple Intelligence. A remote attacker could use it to access sensitive user data. Apple says it fixed the issue in iOS and iPadOS with improved entitlement checks. Apple has not said that any of these additional flaws were exploited in the wild.

Who is affected

According to the ITVedas CVE database, which draws on NVD and CISA, the vulnerability affects iPhone OS (iOS), iPadOS and macOS. The fixed versions are:

• iOS 18.7.11 and iPadOS 18.7.11
• iOS 26.7.1 and iPadOS 26.7.1
• macOS Sequoia 15.8.1
• macOS Tahoe 26.7.1

The new 18.7.11 builds are aimed at these older devices:

• iPhone XS, iPhone XS Max and iPhone XR
• iPad 7th generation
• iPad Air 4th generation and later
• iPad 9th generation and later
• iPad mini 6th generation and later

BleepingComputer notes that CoreGraphics is also used in watchOS and tvOS. However, neither the official CVE record nor Apple's advisory language in the sources lists those platforms as affected by this particular bug. Apple has not said which industries, countries or groups of people were targeted. Its wording points to a small number of specific individuals rather than a mass campaign.

How it works

CoreGraphics is a core Apple framework. It handles two-dimensional drawing on Apple devices, including vector graphics, text rendering and image display. Many apps and system services rely on it, so a weakness here can be reached in many ways.

The bug is an out-of-bounds write, classified as CWE-787. Programs set aside fixed blocks of memory, called buffers, to hold data. An out-of-bounds write happens when software writes data past the end of its buffer and overwrites memory it should not touch. BleepingComputer explains that the results range from crashes and data corruption to an attacker running their own code.

Apple's advisory says that processing a maliciously crafted file may lead to arbitrary code execution, which means an attacker could make the device run instructions of their choosing. Apple fixed the problem by adding stricter bounds checking, so the software now verifies that data fits before writing it.

Apple has not explained how a booby-trapped file reaches a victim, or what an attacker could do after gaining code execution. ITVedas is not speculating about delivery methods.

How serious is it?

The verified CVE data gives CVE-2026-86950 a CVSS score of 8.8, rated High. CVSS (Common Vulnerability Scoring System) is a 0–10 scale used to compare how severe vulnerabilities are. The flaw is also listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. CISA is the US Cybersecurity and Infrastructure Security Agency, and its KEV list tracks bugs with confirmed real-world exploitation.

Both outlets agree on the main facts: the CVE number, the out-of-bounds write in CoreGraphics, the affected versions, the list of older devices, and Apple's statement about targeted exploitation. They emphasise different things:

• The Hacker News treats the backport as part of a larger patch round and covers the new Audio, CoreMedia and Apple Intelligence fixes.
• BleepingComputer credits Meta Product Security with the discovery and places the flaw in Apple's zero-day record for the year. A "zero-day" is a flaw that attackers exploit before a fix exists. It says this is the second Apple zero-day patched in 2026. The first was CVE-2026-20700, an arbitrary code execution bug in dyld, Apple's dynamic link editor, which was patched in February and was also used in "extremely sophisticated" targeted attacks.

BleepingComputer also mentions two other Apple security fixes from earlier this year:

• A high-severity Beats Studio Buds flaw, CVE-2025-20701, that could let attackers within Bluetooth range listen in on conversations.
• Patches for older iPhones and iPads against four vulnerabilities used in cyberespionage and cryptocurrency-theft attacks involving the Coruna exploit kit.

Attacks described as targeting "specific individuals" usually put most ordinary users at lower immediate risk. Still, once a bug is public and patched, others may try to reproduce it. That is one reason BleepingComputer strongly recommends installing the backported fixes.

What to do now

For everyday users:

• Open Settings > General > Software Update on your iPhone or iPad and install the latest version available.
• If you own an iPhone XS, XS Max, XR or one of the listed older iPads, make sure the device reaches iOS or iPadOS 18.7.11.
• On newer devices, update to iOS/iPadOS 26.7.1 or later. iOS 27.2 is now available and includes many additional fixes.
• Mac users should be on macOS Sequoia 15.8.1 or macOS Tahoe 26.7.1 at minimum, or update to the current macOS release.
• Be careful with unexpected files from unknown senders. Apple's advisory centres on maliciously crafted files.

For IT administrators:

• Inventory managed Apple devices and flag any running iOS or iPadOS earlier than 18.7.11 or 26.7.1, or macOS below the fixed builds.
• Use your mobile device management (MDM) tool to push or enforce the updates. Older hardware is often missed, so check it specifically.
• Because the flaw is on CISA's KEV list, organisations that follow KEV remediation guidance should treat it as a priority.
• Give high-risk staff, such as executives, journalists or anyone likely to be a target of spyware-style attacks, priority in the rollout.
• While you are updating, also plan deployment of the 27.2 releases, which fix hundreds of other issues, including the Apple Intelligence authorization bug.

What we still don't know

• Who was targeted and by whom. Apple has not named the victims, the attackers or the regions involved.
• How the attack was delivered. Apple has not said how the crafted file reached targets, or whether other vulnerabilities were chained with this one.
• Exploitation details from Meta. BleepingComputer credits Meta Product Security with the discovery, but the sources do not say whether Meta saw exploitation itself or only reported the bug.
• Status of other platforms. CoreGraphics runs on watchOS and tvOS, but the sources do not say whether those systems were vulnerable to this specific flaw.
• Exploitation of companion fixes. Apple does not indicate that CVE-2026-65339, CVE-2026-86990 or CVE-2026-86987 were abused, and there is no further detail on them.

ITVedas analysis: Apple's month-long gap between patching current systems and older devices once again left the oldest supported hardware exposed for the longest time. Anyone holding on to an iPhone XS or a similar older model should treat 18.7.11 as an essential update.