---
title: Apple fixes a CoreGraphics zero-day (CVE-2026-86950) on older iPhones and iPads with iOS 18.7.11, saying it may have been used in "extremely sophisticated" targeted attacks | ctxsec
url: https://ctxsec.com/items/apple-ios-18-7-11-coregraphics-cve-2026-86950-exploited
description: ""
status: "official (Apple security notes, Oct 26); Apple says may have been exploited in targeted attacks; not in CISA KEV as of Oct 26"
published: 2026-10-27
---

> 

[← Cybersecurity News](/news) · [markdown](/items/apple-ios-18-7-11-coregraphics-cve-2026-86950-exploited.md)

official (Apple security notes, Oct 26); Apple says may have been exploited in targeted attacks; not in CISA KEV as of Oct 26

2026-10-27

### Apple fixes a CoreGraphics zero-day (CVE-2026-86950) on older iPhones and iPads with iOS 18.7.11, saying it may have been used in "extremely sophisticated" targeted attacks

Apple's notes for **iOS and iPadOS 18.7.11** (Oct 26, for iPhone XS, XS Max, XR and iPad 7th generation) list **CVE-2026-86950**, an out-of-bounds write in CoreGraphics where processing a malicious file may lead to arbitrary code execution. Apple says it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." Credit goes to Meta Product Security.

- The same release fixes CVE-2026-65339 (an app may leak sensitive user information, in Audio) and CVE-2026-86990 (camera access without permission, in CoreMedia).
- Apple also shipped iOS/iPadOS 27.2 and 26.7.2, macOS Golden Gate 27.2, Tahoe 26.7.2 and Sequoia 15.8.2, Safari 27.2, tvOS, watchOS and visionOS 27.2 the same day. CVE-2026-86950 is not listed in those notes, and none of them flags another exploited bug.

**What to do:** update any XS/XR-era iPhones and 7th-generation iPads still in use to 18.7.11, and move other devices to the latest iOS 27.2 or 26.7.2. People at higher risk (journalists, executives, activists) should consider Lockdown Mode.

Sources: [Apple: About the security content of iOS 18.7.11 and iPadOS 18.7.11 (Oct 26)](https://support.apple.com/en-us/149225) · [Apple security releases](https://support.apple.com/en-us/100100) · [Apple: About the security content of iOS 27.2 and iPadOS 27.2](https://support.apple.com/en-us/149230)