Apple released iOS 18.7.11 and iPadOS 18.7.11 on October 26 to fix CVE-2026-86950, an out-of-bounds write in CoreGraphics that Apple says may have been exploited against specific targeted individuals. The release extends a fix already available on newer operating systems to older devices.
The account here rests on a single outlet’s report of Apple’s security notes, and the details should be read with that in mind.
CVE-2026-86950 Out-of-Bounds Write Allows Code Execution From a Crafted File
The flaw is an out-of-bounds write in CoreGraphics. Processing a maliciously crafted file can lead to arbitrary code execution. It carries a CVSS score of 8.8. Apple says the flaw may have been exploited against specific targeted individuals, and credits Meta Product Security with reporting it.
Which iPhones and iPads Receive the iOS 18.7.11 Update
The update covers iOS 18 and iPadOS 18 devices that cannot move to the newer release line. Listed devices include the iPhone XS, XS Max and XR, the iPad 7th generation, the iPad Air from the 4th generation, the iPad 9th generation and later, and the iPad mini from the 6th generation.
A Month-Long Gap After CISA Listed the Flaw as Exploited
CISA added CVE-2026-86950 to its Known Exploited Vulnerabilities catalog on September 29, 2026. The same fix had already shipped in iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1. Devices running iOS 18 stayed unprotected for about a month while a known exploited flaw sat in their CoreGraphics code.
Older Devices Left Behind While Newer Releases Carried the Fix
The sequence meant that owners of hardware unable to run the newest release had no patch from Apple for the period between the newer-release fixes and the 18.7.11 update. Apple has not said in the material cited why the backport followed later than the other releases.
Two Other Flaws Fixed in iOS 18.7.11 Alongside CVE-2026-86950
The 18.7.11 release also addresses two other bugs reported by Mustafa Calap of dbg.re. Meta Red Team X is credited for an Audio flaw. Apple does not report exploitation of those two issues.
The credit to Meta Product Security for the exploited CoreGraphics bug is notable because the report identifies the discoverer as a company security team rather than an independent researcher, though the coverage does not say how Meta learned of the activity.
Verifying the Details Against Apple’s Own Security Notes
Because the account depends on a single outlet, the version numbers, CVE identifier and device list should be checked against Apple’s published security notes. Apple’s wording that exploitation “may have” occurred, limited to specific targeted individuals, is the vendor’s stated position on the scale of attacks.
The update is the fix for older iPhones and iPads that CISA’s September listing had left without a patch option.
Timeline From the September KEV Listing to the 18.7.11 Release
The sequence of dates frames the exposure. CISA listed CVE-2026-86950 in its catalog of exploited vulnerabilities on September 29, 2026. Apple’s newer operating system releases, iOS 26.7.1 and iPadOS 26.7.1 along with macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1, already contained the repair. The iOS 18 and iPadOS 18 fix followed on October 26.
For owners of older iPhones and iPads that cannot run newer iOS, the practical result was a known exploited flaw left unpatched on their devices for about a month. The only guidance in the report is for those users to install iOS or iPadOS 18.7.11.
The report says Meta Product Security reported the CoreGraphics flaw, and that Meta Red Team X is credited on a separate Audio flaw in the same release. Mustafa Calap of dbg.re reported two other bugs fixed in the update. Apple does not report exploitation of those two issues or of the Audio flaw.
