CVE-2026-86950 (CVSS score: 8.8) is an out‑of‑bounds write in CoreGraphics that “may have been exploited in an extremely sophisticated attack against specific targeted individuals,” Apple said.
CVE-2026-86950: a CoreGraphics memory-corruption flaw with real‑world concern
Apple has identified CVE-2026-86950 as a high‑severity CoreGraphics vulnerability that can result in arbitrary code execution when a device processes a maliciously crafted file. The company assigned the flaw a CVSS score of 8.8 and said it was aware of a report that the issue "may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27."
Apple initially released patches last month in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, and on Monday expanded fixes to include older iPhone and iPad models via iOS 18.7.11 and iPadOS 18.7.11.
Backporting the fix: iOS 18.7.11 and device coverage
The recent updates — iOS 18.7.11 and iPadOS 18.7.11 — extend the CoreGraphics fix to devices that run the 18.x branch. According to Apple’s release, those updates cover a range of older hardware, specifically iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. The move brings protections to devices that otherwise would have remained on older builds vulnerable to the exploited flaw.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildRelated fixes: Audio and CoreMedia CVEs in the same updates
Alongside CVE-2026-86950, iOS 18.7.11 and iPadOS 18.7.11 also address two additional vulnerabilities:
- CVE-2026-65339 — a logic issue in Audio that could be exploited by an app to leak sensitive user information.
- CVE-2026-86990 — an access vulnerability in CoreMedia that could be abused by a malicious app to access the camera without user permission.
Including these fixes in the same updates means the new builds mitigate both a memory‑corruption route to arbitrary code execution and application‑level issues that could expose data or privacy on affected devices.
Broader patching: iOS 27.2 and dozens of other fixes
Separately, Apple shipped iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2, visionOS 27.2, and Safari 27.2, which the company said fixed hundreds of vulnerabilities across many components. Apple listed fixes in AppleAVD, CoreAudio, ImageIO, kernel, Model I/O, Screen Sharing Server, Spotlight, StorageKit, and WebKit.
Among those defects, Apple called out an authorization issue in Apple Intelligence tracked as CVE-2026-86987 that could be exploited by a remote attacker to access sensitive user data. Apple said the issue was addressed in iOS and iPadOS with improved entitlement checks. The company did not, in that release, state that these broadly enumerated defects had been exploited in the wild.
How end users, enterprises, and adversaries are likely to respond
- End users: Owners of the named devices — including iPhone XS/XS Max/XR and the listed iPad models — will be expected to install iOS 18.7.11 or iPadOS 18.7.11 to close the CoreGraphics route to arbitrary code execution and to mitigate the Audio and CoreMedia issues.
- Enterprises and procurement leaders: Organizations that manage fleets with the listed older devices should prioritize these backports in their update rollouts to ensure coverage of both the memory‑corruption exploit and the app‑level information‑leak and camera access flaws.
- Adversaries and threat actors: Apple’s note that the CoreGraphics flaw "may have been exploited in an extremely sophisticated attack against specific targeted individuals" signals that attackers have at least reportedly used this vector in targeted operations, which defenders and investigators will factor into threat assessments and incident response.
Apple’s step to backport the CoreGraphics fix to iOS 18.7.11 and iPadOS 18.7.11 underscores two realities supplied in the company’s advisories: the flaw carries high technical severity (CVSS 8.8) and there is at least one report of its use against targeted individuals. For practical purposes the record is simple and actionable: install the available updates — iOS 18.7.11, iPadOS 18.7.11, or the latest 27.2 builds where supported — to receive protections for CoreGraphics, Audio, CoreMedia, and the wider set of vulnerabilities Apple patched.
