Apple iOS e iPadOS · Exploitation confirmed

Apple Patches Exploited CoreGraphics Zero-Day on Older iPhones

Oct 27, 2026 · 1 min read

Apple has backported the fix for CVE-2026-86950 to older iPhones and iPads via iOS 18.7.11 and iPadOS 18.7.11. The out-of-bounds write in CoreGraphics was exploited as a zero-day in what Apple called an extremely sophisticated attack and had already been patched in newer OS versions in late September. Users of older devices should install the update now.

By HIFY Radar newsroom Updated 10/27/2026 01:37 PM Get this every day →← Back to the feed 4 sources

HighVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Apple released iOS 18.7.11 and iPadOS 18.7.11, bringing the fix for CVE-2026-86950, a flaw already used in real-world attacks, to older iPhones and iPads. According to Apple, the flaw was exploited before a fix existed, in an attack the company described as extremely sophisticated. Newer operating systems had already received the fix in late September.

Why it matters

The flaw allows a maliciously crafted file, once processed by the device, to run unauthorized code. Apple called the attacks extremely sophisticated and, according to The Hacker News, said they may have targeted specific individuals. Older devices without the update remain exposed.

What to do

Update older iPhones and iPads to iOS 18.7.11 or iPadOS 18.11 today via Settings, General, Software Update. Verify that devices on newer systems already run the patched September versions.

For the technical team

CVE: CVE-2026-86950
Affected: Apple iOS e iPadOS (CoreGraphics) em iPhones e iPads mais antigos, incluindo iOS 18 · Older iPhones and iPads running iOS 18 and iPadOS 18 (models not specified in the sources). iOS and macOS 27 do not appear to be affected, according to SecurityWeek.
Exploitation: SecurityWeek reports the flaw was exploited as a zero-day in what Apple described as an extremely sophisticated attack. The Hacker News says Apple stated the flaw may have been used in targeted attacks against specific individuals. SecurityWeek says there is no public information detailing the attacks.
Fix: iOS 18.7.11 and iPadOS 18.7.11, which fix three vulnerabilities, including CVE-2026-86950. Original patches in late September: iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
Vector: Out-of-bounds write in CoreGraphics, CVSS 8.8 according to The Hacker News. Processing a maliciously crafted file can result in arbitrary code execution. No public details on how the attacks were delivered, according to SecurityWeek.
More details: Flaw discovered by Meta's product security team, according to SecurityWeek. On the same day, Apple released iOS and iPadOS 27.2 and macOS Golden Gate 27.2, with 286 vulnerabilities fixed across the two systems, plus iOS and iPadOS 26.7.2 (134 fixes), macOS Tahoe 26.7.2 (213), macOS Sequoia 15.8.2 (197), tvOS 27.2 (72), watchOS 27.2 (62), visionOS 27.2 (125) and Safari 27.2 (33).

Timeline

10/27/2026 01:37 PM
New details: the flaw is an out-of-bounds write in CoreGraphics (CVSS 8.8) that allows arbitrary code execution when processing a maliciously crafted file; the original fixes were released last month.
10/27/2026 11:02 AM
The flaw was assigned CVE-2026-86950 and the fix is now available in iOS 18.7.11 and iPadOS 18.7.11, covering older iPads as well.
10/27/2026 08:59 AM
Apple ships iOS and macOS 27.2 with 286 fixes and brings the patch for the exploited CoreGraphics zero-day to iOS 18.

Want the next updates in your inbox? Get the daily edition →

See all 4 updates