Science & Tech · Cybersecurity · 9 hrs ago
Apple patches exploited security flaw on older iPhones and iPads
Apple extended a security fix to older iPhones and iPads on Monday, including the iPhone XS, XS Max and XR and several iPad models.
The fix addresses a CoreGraphics flaw that may have been exploited in targeted attacks against specific people using older versions of iOS.
CoreGraphics handles graphics, text and images, and a malicious file could use the flaw to run code on a device.
Apple first released a fix last month for newer software versions, and has now included it in iOS 18.7.11 and iPadOS 18.7.11.
The updates also fix two other security issues that could let an app expose sensitive information or access the camera without permission.
These vulnerabilities matter because they could put users' data and privacy at risk.
Owners of supported older devices can install the updates to get the fixes; Apple also released updates for newer operating systems.
Apple has extended a fix for an exploited CoreGraphics security flaw to older iPhones and iPads.
The flaw, tracked as CVE-2026-86950, could allow arbitrary code execution when a device processes a maliciously crafted file.
Apple said the flaw may have been used in highly sophisticated attacks against specific individuals using versions of iOS before iOS 27.
The new patches are available in iOS 18.7.11 and iPadOS 18.7.11 for a range of older devices.
The updates also fix two other security issues affecting Audio and CoreMedia.
- Who
- Apple released the patches. Meta Product Security discovered the CoreGraphics flaw.
- What
- Apple backported a fix for CVE-2026-86950 to older iPhones and iPads.
- When
- Monday, according to Apple; the articles were published on October 27, 2026.
- Where
- On supported iPhones and iPads running iOS or iPadOS.
- Why
- The flaw may have been exploited in sophisticated attacks targeting specific individuals and could allow arbitrary code execution.
This story does not have two clearly opposing sides.
Apple patched the flaw in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
Apple extended the fix to iOS 18.7.11 and iPadOS 18.7.11 for older devices.
- Vulnerability
- CVE-2026-86950
- Affected component
- CoreGraphics
- Patch versions
- iOS 18.7.11 and iPadOS 18.7.11
- Affected phones
- iPhone XS, iPhone XS Max and iPhone XR
- Affected tablets
- iPad 7th generation; iPad Air 4th generation and later; iPad 9th generation and later; iPad mini 6th generation and later
3 sources
What people are saying
Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27
Processing a maliciously crafted file may lead to arbitrary code execution. An out-of-bounds write issue was addressed with improved bounds checking.