Apple backports CoreGraphics fix to older iPhones and seventh-generation iPad

Apple made security updates available on Oct. 26 that backport a fix for CVE-2026-86950, a CoreGraphics vulnerability, to the iPhone XS, iPhone XS Max, iPhone XR and the seventh-generation iPad.

Those four models cannot run iOS 26, so iOS 18.7.11 and iPadOS 18.7.11 bring the repair to devices still running iOS 18 without requiring an unsupported operating system upgrade. A backport moves a repair from a newer release onto an older release.

CVE-2026-86950 is an out-of-bounds write flaw in CoreGraphics, the Apple framework used to draw graphics, images and PDF content. The framework also renders images, draws text and creates two-dimensional vector graphics on iOS, iPadOS, macOS, watchOS and tvOS. In this flaw class, software writes data beyond the memory set aside for it, which can crash programs, corrupt data or allow remote code execution. Apple issued the fix by checking memory boundaries more strictly as data is processed.

Apple says it knows of a report that the weakness was used in an advanced, precisely aimed intrusion against particular individuals, and that the reported intrusion targeted iOS releases earlier than iOS 27. Apple says CVE-2026-86950 was used only in highly targeted attacks. This class of attack typically aims at journalists, activists and officials. Meta Product Security discovered the out-of-bounds write weakness tracked as CVE-2026-86950 in CoreGraphics.

Apple first addressed the flaw in iOS 26.7.1. In September, Apple patched iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, and newer supported devices already received the fix then. The backport now covers iPhone XS, XS Max, XR and the seventh-generation iPad, plus iPad mini 6th generation and later, iPad 9th generation and later, and iPad Air 4th generation and later.

The same release set also shipped iOS 26.7.2, iPadOS 26.7.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2 and tvOS 26.6.1. iOS 26.7.2 and iPadOS 26.7.2 fix a total of 134 vulnerabilities, and Apple says it has no information that any of those 134 was actively exploited. The tvOS update lets Apple TV HD and first-generation Apple TV 4K work with the fourth-generation Siri Remote.

Apple also released iOS 27.2 the same day for iPhone 11 and later; its security notes list 163 fixes. The same day brought updates to macOS Golden Gate 27.2, watchOS 27.2, tvOS 27.2, visionOS 27.2 and Safari. iOS 27.2 extends Siri AI, which remains in beta, to French, Japanese, Korean, Portuguese and Spanish, with daily usage limits and broader access requiring payment later.

This year Apple has patched two zero-days exploited in attacks. The second is CVE-2026-20700, an arbitrary code execution flaw in dyld used in sophisticated targeted attacks and patched in February. Earlier this year Apple also fixed a high-severity Beats Studio Buds flaw, CVE-2025-20701, that lets attackers within Bluetooth range listen to conversations. Apple also fixed four flaws tied to cyberespionage and crypto-theft attacks that used the Coruna exploit kit on older iPhones and iPads.

iPhone and iPad users check for updates in Settings, General, Software Update and can enable Automatic Updates there. Installing the backported patches is strongly advised to block potential attacks. Users who believe they might be targets of highly sophisticated spyware should update, restart the phone and consider Lockdown Mode. All updates are available now.

iOS 18.7.11 is a small update with three fixes for iPhone XS, iPhone XS Max and iPhone XR, including a separate fix that blocks a malicious app from activating the camera without consent. Apple’s security releases page lists every update together with its security notes.