Vulnerabilities · 4h ago

Apple extends exploited CoreGraphics fix to iOS 18

Apple has backported the fix for exploited CoreGraphics zero-day CVE-2026-86950 to iOS and iPadOS 18.7.11, after patching it in newer releases in late September. Meta’s product security team discovered the flaw, which Apple said was used in an “extremely sophisticated attack.”

CoreGraphics handles graphics and image content; the flaw was an out-of-bounds write, meaning crafted content could make it write beyond the memory set aside for it. Apple has not disclosed how attackers delivered that content or what a victim needed to do, so the public record does not show the attack path.

For organizations still managing iOS 18, 18.7.11 closes a gap left by fixes for newer releases—but update compliance cannot show whether a device was targeted or compromised. The patch narrows the known exposure; the extent of the campaign remains unknown.

CVE-2026-86950

NVD KEV

Known exploited · CISA KEV

CVSS 8.8 HIGH: an out-of-bounds write issue was addressed with improved bounds checking.

CISA federal remediation date Oct 2 · date passed

Timeline

Oct 27 Reported by SecurityWeek
Oct 2 CISA federal deadline for CVE-2026-86950 passed
Sep 29 CVE-2026-86950 added to CISA KEV

Sources

2 sources covering this story

SecurityWeek Oct 27
iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
Apple patched 286 vulnerabilities in iOS and macOS 27.2 and brought the fix for an exploited CoreGraphics zero-day to older iPhones.
BleepingComputer Oct 27
Apple backports CoreGraphics zero-day patches to older iPhones
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in

Entities

CVE-2026-86950

Part of the PlainSec briefing for 2026-10-27

Editions

Briefing for 2026-10-27

Vulnerabilities · 4h agoApple extends exploited CoreGraphics fix to iOS 18Apple has backported the fix for exploited CoreGraphics zero-day CVE-2026-86950 to iOS and iPadOS 18.7.11, after patching it in newer releases in late September. Meta’s product security team discovered the flaw, which Apple said was used in an “extremely sophisticated attack.”CoreGraphics handles graphics and image content; the flaw was an out-of-bounds write, meaning crafted content could make it write beyond the memory set aside for it. Apple has not disclosed how attackers delivered that content or what a victim needed to do, so the public record does not show the attack path.For organizations still managing iOS 18, 18.7.11 closes a gap left by fixes for newer releases—but update compliance cannot show whether a device was targeted or compromised. The patch narrows the known exposure; the extent of the campaign remains unknown.