Apple released iOS 18.7.11 and iPadOS 18.7.11 on October 26, 2026, extending a CoreGraphics security fix to older iPhones and iPads. The company has flagged the vulnerability, tracked as CVE-2026-86950, for possible exploitation in targeted attacks.
Apple describes the flaw as an out-of-bounds write that could allow arbitrary code execution when a device processes a maliciously crafted file. The company says it addressed the issue by improving bounds checking.
“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27,” the company said.
Apple’s security release list identifies the iPhone XS, iPhone XS Max, iPhone XR and seventh-generation iPad as the devices covered by iOS 18.7.11 and iPadOS 18.7.11.
Earlier patches and additional fixes
Apple’s September security notices list fixes for the same CoreGraphics vulnerability in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Those updates were released on September 28, 2026, and carried the same warning about possible exploitation against specific individuals.
The October release extends that fix to the older software branch and addresses two additional vulnerabilities involving sensitive information and camera access.
The Audio flaw, CVE-2026-65339, could allow an app to leak sensitive user information, Apple says. Its security notice describes a logic issue and says the company addressed it with improved checks.
The CoreMedia vulnerability, CVE-2026-86990, could allow a malicious app to access the camera without the user’s permission. Apple says it resolved the access issue by improving access restrictions.
Wider October security updates
Apple’s release schedule also lists iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2, visionOS 27.2 and Safari 27.2 with an October 26 release date. These form part of a broader set of Apple security updates across its operating systems and browser.
The security notices cover vulnerabilities in components including AppleAVD, CoreAudio, ImageIO, the kernel, Model I/O, Screen Sharing Server, Spotlight, StorageKit and WebKit.
Among the issues documented for iOS 27.2 and iPadOS 27.2 is an authorization flaw in Apple Intelligence, tracked as CVE-2026-86987. Apple says a remote attacker may be able to access sensitive user data through that vulnerability. The company says it addressed the Apple Intelligence issue with improved entitlement checks.
