Skip to content
Hacker Posts

Apple backports CoreGraphics zero-day fix (CVE-2026-86950) to iOS 18

Apple shipped iOS/iPadOS 18.7.11 to backport the fix for CVE-2026-86950, a CoreGraphics zero-day Apple says was used in targeted attacks, to older iPhones and iPads.

Published 3 min read
cveappleioszero-dayexploited-in-the-wild

Apple has extended the fix for an exploited CoreGraphics zero-day to its older device line, releasing iOS 18.7.11 and iPadOS 18.7.11 on October 26. The flaw, CVE-2026-86950, was first patched in late September on current hardware; the backport closes it on iPhones and iPads that can't run iOS 27. If you manage a fleet with legacy handsets, this is the update that finally covers them.

What the bug does

CVE-2026-86950 is an out-of-bounds write in CoreGraphics, Apple's low-level 2D rendering framework. Per Apple's advisory, "Processing a maliciously crafted file may lead to arbitrary code execution," addressed "with improved bounds checking." Because CoreGraphics parses image and document data across the OS, a malicious file delivered through any app that renders it is a viable path.

The flaw was reported by Meta Product Security.

Exploitation status

Confirmed by Apple, and the reason this backport exists. Apple's advisory states it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." That phrasing — "extremely sophisticated" and "specific targeted individuals" — is Apple's standard language for mercenary-spyware-grade activity, not opportunistic mass exploitation. No actor or spyware vendor is named.

Affected versions and fixes

  • Current line (fixed late September): iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
  • Older line (new, Oct 26): iOS 18.7.11 and iPadOS 18.7.11. Apple's advisory lists the backport reaching iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. The 18.7.11 update fixes three vulnerabilities in total, including CVE-2026-86950.

iOS and macOS 27 do not appear to be affected. Separately, SecurityWeek notes Apple's concurrent iOS and macOS 27.2 release patches 286 bugs across platforms — routine volume, unrelated to the exploited flaw.

Action checklist

  1. Push 18.7.11 to every device still on the iOS/iPadOS 18 line today. These are the only devices that remained exposed after September's fix.
  2. Confirm current-line devices are on 26.7.1 or later (or 27.x), which already carry the fix.
  3. For high-risk users — journalists, executives, activists, anyone a mercenary-spyware operator might target — prioritize the update and consider enabling Lockdown Mode, which blunts this class of file-parsing attack.
  4. MDM operators: mark 18.7.11 mandatory and verify the backport covers your oldest enrolled hardware (XS/XR-era iPhones).

Context

A backport arriving a month after the primary patch is a reminder that "patched" and "patched on your device" are different states. Apple fixes the flaw first on the hardware that runs the current OS, then circles back to the long-tail devices — and those long-tail devices are disproportionately the ones in the hands of users who hold onto phones for years. For a targeted-attack bug, the gap between those two dates is exactly the window a well-resourced operator would want.

Related stories