Apple Extends Fix for Actively Exploited CoreGraphics Flaw to Older iPhones and iPads

Apple has extended a fix for a high-severity flaw, tracked as CVE-2026-86950 (CVSS score: 8.8), to older devices. The vulnerability is an out-of-bounds write in CoreGraphics that could allow arbitrary code execution when a device processes a maliciously crafted file. Apple said it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

The original patches were released last month in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. The fix now also appears in iOS 18.7.11 and iPadOS 18.7.11, covering devices including the iPhone XS, XS Max and XR, the iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. These updates also address two further issues: a logic flaw in Audio (CVE-2026-65339) that could let an app leak sensitive user information, and an access flaw in CoreMedia (CVE-2026-86990) that could let a malicious app use the camera without permission.

Separately, Apple released version 27.2 updates across its platforms, fixing hundreds of vulnerabilities. One notable issue is an authorization flaw in Apple Intelligence (CVE-2026-86987) that a remote attacker could exploit to access sensitive user data. Apple does not say any of these other flaws were exploited in the wild, but keeping devices current remains good practice.