Apple Patches Potentially Exploited CoreGraphics Zero-Day on Older iPhones and iPads
Active Exploitation · 17 sources · Updated 5d ago · First seen Oct 27, 2026
Apple released iOS 18.7.11 and iPadOS 18.7.11 to patch three vulnerabilities on older devices, including CVE-2026-86950, a CoreGraphics out-of-bounds write that could allow arbitrary code execution when processing a maliciously crafted file. Apple warned that the flaw may have been exploited in extremely sophisticated attacks against specific individuals running versions before iOS 27. The advisory does not identify attackers or victims, or establish whether exploitation required user interaction.
The updates also address an Audio information-disclosure flaw, CVE-2026-65339, and a CoreMedia camera-permission bypass, CVE-2026-86990; neither was flagged as exploited. Apple separately released iOS 26.7.2 and iPadOS 26.7.2 with fixes covering 134 vulnerabilities, none reported as exploited, alongside macOS and tvOS updates. The macOS advisory covers risks including privileged code execution, sandbox escapes, Gatekeeper bypasses and sensitive-data exposure. Organizations should prioritize updating older managed iPhones and iPads, particularly those used by individuals at elevated risk of targeted attacks, while deploying the broader platform fixes.
