Apple Backports Fix for Exploited Core Graphics Flaw to Older iPhones and iPads
Summary: Apple backported fixes for CVE-2026-86950, a CoreGraphics out-of-bounds write rated CVSS 8.8 that can execute arbitrary code when processing a maliciously crafted file, to iOS 18.7.11 and iPadOS 18.7.11 covering iPhone XS, iPhone XS Max, iPhone XR and several iPad and iPad mini models. Apple said it is aware of a report that the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27, after first shipping patches last month in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
Bottom line: Apple's own wording - an extremely sophisticated attack against specific targeted individuals - means the exploit was aimed at particular people, not the general population, and the same 18.7.11 release also closes a CoreMedia access flaw that lets a malicious app reach the camera without user permission.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-65339CVE-2026-86950CVE-2026-86987CVE-2026-86990
- Related
- CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Sep 29, 2026