Apple backports zero-day fix to iPhone XS, XR and older iPads

Apple has released iOS 18.7.11 and iPadOS 18.7.11 to extend the CVE-2026-86950 fix to devices maintained on version 18. The CoreGraphics vulnerability has been associated with highly targeted attacks. Published on October 26, the package also closes flaws that could allow unauthorized camera access and the exposure of sensitive information.

Apple’s bulletin says processing a maliciously crafted file may result in arbitrary code execution. The company is aware of a report that the flaw “may have been exploited” in an extremely sophisticated attack against specific individuals using versions before iOS 27. That wording does not confirm exploitation across every affected device or describe an indiscriminate campaign.

A fix that reached newer system branches first

CVE-2026-86950 is an out-of-bounds write in CoreGraphics, a component used to process images, text and other graphical elements. When a program writes data outside its allocated memory region, the result can range from an application crash to the execution of attacker-controlled code. Apple addressed the problem with improved bounds checking.

The first round of patches arrived on September 28 in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. The October release brings protection to the 18.7.11 branch. Apple’s general release page highlights iPhone XS, iPhone XS Max, iPhone XR and the 7th-generation iPad. The technical bulletin also names the 4th-generation or later iPad Air, 9th-generation or later iPad and 6th-generation or later iPad mini.

That broader list reflects how some tablets eligible for newer systems may remain on an earlier maintenance branch. The safest way to identify the appropriate version is to use the update offered by the device itself under Settings, General and Software Update rather than installing files from an outside source.

What is known about exploitation

The flaw was credited to Meta Product Security. Apple did not identify the targets, number of affected devices, crafted file used as the vector or operator behind the activity. There is therefore no public basis for attributing the attack to a government, company or criminal group.

What is confirmed is that the US Cybersecurity and Infrastructure Security Agency added CVE-2026-86950 to its Known Exploited Vulnerabilities catalog on September 29. The US National Vulnerability Database displays a high-severity assessment supplied by CISA, with a score of 8.8, and indicates that user interaction is required.

That makes the update important, but it does not mean any ordinary file will automatically compromise a device. The content must be designed to trigger the flaw and reach the affected system through some channel. Because Apple has not described the vector used in the reported attacks, it is not possible to state whether exploitation required manually opening a file, viewing a preview or taking another action.

The update also closes two privacy flaws

iOS and iPadOS 18.7.11 include two other fixes. CVE-2026-86990 in CoreMedia could allow a malicious app to access the camera without permission; Apple added stronger access restrictions. CVE-2026-65339 in the audio system could allow an app to leak sensitive information, and the company addressed the logic error with additional checks.

Apple does not say those two vulnerabilities were exploited. They should be treated as corrected risks, not evidence that applications have accessed every user’s camera or data. That distinction prevents the existence of a vulnerability from being presented as proof of compromise.

For owners of compatible devices, the practical consequence is straightforward: installing the update reduces exposure to all three documented flaws. The backport also demonstrates why maintaining security updates for devices outside the main operating-system generation matters, since vulnerabilities in shared components can affect several branches at once.