Apple Released Patches for Exploited CoreGraphics 0-day Vulnerability for Older iPhones

What happened?

Apple released iOS 18.7.11 and iPadOS 18.7.11 to patch a CoreGraphics zero-day vulnerability that attackers may have used in targeted attacks. Released on October 26, 2026, the updates bring security fixes to older devices, including the iPhone XS, iPhone XS Max, iPhone XR, and seventh-generation iPad, according to Apple’s security releases page. Tracked as CVE-2026-86950, the CoreGraphics flaw can allow attackers to run code when a device processes a specially crafted file. Apple credits Meta Product Security with reporting the issue.

Key details

• Apple released iOS 18.7.11 and iPadOS 18.7.11 on October 26, 2026 to patch a CoreGraphics zero-day vulnerability.
• The CoreGraphics flaw CVE-2026-86950 allows code execution when a specially crafted file is processed.
• Apple acknowledges the vulnerability may have been exploited in targeted attacks against specific individuals using iOS versions before iOS 27.
• CVE-2026-86990 in CoreMedia could allow a malicious app to access the camera without user permission.
• Older devices including iPhone XS, iPhone XS Max, iPhone XR, and seventh-generation iPad receive this security update on the iOS 18 branch.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.