Skip to content
Apple Issues Security Update for Older iPhones and iPads to Fix Exploited CoreGraphics Flaw

Apple Issues Security Update for Older iPhones and iPads to Fix Exploited CoreGraphics Flaw

First seen 29 Oct 2026, 14:13 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 15:14 UTC
  • •Apple's iOS 18.7.11 update fixes a critical CoreGraphics flaw (CVE-2026-86950).
  • •Affected devices include iPhone XR, XS, XS Max, and seventh-generation iPad.
  • •The vulnerability may have been exploited in targeted attacks against specific individuals.

Apple released iOS 18.7.11 and iPadOS 18.7.11 on October 26, 2026, to address a CoreGraphics vulnerability (CVE-2026-86950) that may have been exploited in sophisticated attacks against targeted individuals. This update specifically affects older devices, including the iPhone XR, iPhone XS, iPhone XS Max, and seventh-generation iPad, which cannot upgrade to iOS 26 or 27. The flaw is an out-of-bounds write issue that could allow arbitrary code execution when processing malicious files. Apple has not disclosed the delivery method of the malicious files or the number of affected individuals. This is the second zero-day vulnerability Apple has acknowledged this year.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-02-11
CVE-2026-20700 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-28
CVE-2026-86950 published
Apple disclosed the CoreGraphics vulnerability, which could lead to arbitrary code execution.
Apple.Gadgethacks
2026-09-29
CVE-2026-86950 added to CISA KEV
The vulnerability was added to the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation.
Apple.Gadgethacks
2026-10-26
Apple releases iOS 18.7.11 update
Apple released the update to fix the CoreGraphics flaw for older devices that cannot upgrade to iOS 26.
Malwarebytes

More articles in this cluster (4)

Following this threat?

Track CVE-2026-20700 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 3

Common questions

Which devices need the update?
The update is necessary for iPhone XR, XS, XS Max, and seventh-generation iPad users.
What does the update fix?
It addresses a CoreGraphics vulnerability that may allow arbitrary code execution through malicious files.
Is this vulnerability actively exploited?
Yes, Apple indicated that the flaw may have been exploited in targeted attacks.