On October 26, 2026, Apple released iOS 18.7.11 and iPadOS 18.7.11 — a security update for legacy iPhone and iPad models that backports the fix for the CVE-2026-86950 vulnerability in the CoreGraphics component. According to Apple, this vulnerability could have been used in “highly sophisticated attacks” against specific individuals. Owners of iPhone XS, XS Max, XR and several iPad models should install the update immediately — the patch closes a gap where processing a specially crafted file leads to arbitrary code execution.
Technical details of the vulnerability
CVE-2026-86950 is classified as an out-of-bounds write (write outside the bounds of a buffer, CWE-787 according to NVD). The vulnerability affects the CoreGraphics subsystem — the framework responsible for processing graphic data across all Apple operating systems. When a specially crafted file is opened, an attacker gains the ability to execute arbitrary code on the victim’s device.
The CVSS 3.1 severity score is 8.8 (High). An important clarification: this score was assigned by CISA-ADP, not NVD — NVD’s own assessment was not yet available at the time of publication. The attack vector is network-based, with low exploitation complexity and no need for privileges, but requiring user interaction (opening a file).
Apple initially fixed this vulnerability on September 28, 2026, in iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. However, those updates only covered devices that support current OS branches. The fix has now been extended to the legacy 18.x branch, closing the gap for owners of older models.
Which devices are affected
The iOS 18.7.11 and iPadOS 18.7.11 update is intended for:
- iPhone XS, iPhone XS Max, iPhone XR
- iPad 7th generation
- iPad Air 4th generation and later
- iPad 9th generation and later
- iPad mini 6th generation and later
Owners of newer devices that support iOS 27 should use the 27.2 branch, which was released at the same time and contains fixes for hundreds of vulnerabilities.
Exploitation and threat context
Apple reports that CVE-2026-86950 “may have been used in a highly sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” The wording is cautious — the company speaks of possible exploitation rather than confirmed. No independent confirmation of these attacks from third-party researchers or government agencies has been found. Attribution — who is behind the attacks and who the victims were — is not disclosed.
We have already written about this vulnerability when the initial patch was released in September, and also analyzed the public PoC exploit and the question of possible delivery vectors. The current backport is a logical continuation of this story: Apple is closing the vulnerability window for devices that were left unprotected after the September update.
Additional fixes in iOS 18.7.11
In addition to CVE-2026-86950, the update fixes two more vulnerabilities:
- CVE-2026-65339 (Audio) — a logic issue that allows an application to gain access to the user’s sensitive information.
- CVE-2026-86990 (CoreMedia) — an access vulnerability through which a malicious application can activate the camera without the user’s permission.
Also noteworthy is CVE-2026-86987 in the Apple Intelligence component, fixed in iOS 27.2 and iPadOS 27.2. This is an authorization flaw that allows a remote attacker to gain access to sensitive data. The vulnerability affects only devices that support Apple Intelligence (iPhone 15 Pro and later), so it is not included in the 18.x branch.
Recommendations
The update priority is high. The specific actions depend on your device model:
- iPhone XS/XR, iPad 7th generation and other devices from the list above — install iOS/iPadOS 18.7.11 via “Settings → General → Software Update”.
- Devices that support iOS 27 — update to iOS/iPadOS 27.2.
- Mac — make sure macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1 (or newer versions) are installed.
Given that the CVE-2026-86950 vulnerability is exploited through file processing, avoid opening attachments and documents from untrusted sources until you install the update — especially graphic files received via messengers or email.
The backport of the patch to the legacy iOS 18.x branch is an atypical step for Apple, underscoring the seriousness of the threat. Owners of affected devices should not delay installation: the vulnerability has already been used in real attacks, a public PoC exists, and the update is available right now.
