Apple Released Patches for Exploited CoreGraphics 0-day Vulnerability for Older iPhones

Apple released iOS 18.7.11 and iPadOS 18.7.11 to patch a CoreGraphics zero-day vulnerability that attackers may have used in targeted attacks.

Released on October 26, 2026, the updates bring security fixes to older devices, including the iPhone XS, iPhone XS Max, iPhone XR, and seventh-generation iPad, according to Apple’s security releases page.

Tracked as CVE-2026-86950, the CoreGraphics flaw can allow attackers to run code when a device processes a specially crafted file. Apple credits Meta Product Security with reporting the issue.

The company says it is aware of a report that the flaw “may have been exploited in an extremely sophisticated attack against specific targeted individuals” using iOS versions before iOS 27.

The vulnerability is an out-of-bounds write in CoreGraphics, an Apple component that handles graphics and documents. This bug occurs when software writes data beyond the memory space it’s allocated.

Apple Fix for CoreGraphics 0-Day Flaw

A crafted file can trigger that error and potentially let an attacker run code within the affected process. Apple fixed the issue by adding stronger bounds checks.

The latest release extends protection to older hardware. Cybersecurity News previously covered Apple’s CoreGraphics zero-day patch for newer iPhones, reporting that iOS 26.7.1 and iPadOS 26.7.1 addressed the same CVE in September. Owners of older models now have a security update available on the iOS 18 branch.

Apple’s warning points to targeted exploitation, but the supplied advisory does not name the attackers, identify victims, or explain how the malicious file reached their devices.

It also does not say whether exploitation required user interaction. The available information therefore does not establish a zero-click attack or a wider campaign against ordinary users.

The update also addresses CVE-2026-65339 in the Audio component. Apple says an app could use this logic flaw to leak sensitive user information. The company added improved checks and credited Mustafa Calap (@ordinal0 of dbg. re, and Nik Tsytsarkin of Meta Red Team X.

A third issue, CVE-2026-86990, affects CoreMedia and could allow a malicious app to access the camera without user permission. Apple tightened access restrictions to fix the problem and credited Mustafa Calap. Unlike the CoreGraphics entry, neither of these entries includes an exploitation warning in the supplied advisory.

Apple has previously patched exploited vulnerabilities on older devices, including the iOS 12.5.7 update for an exploited WebKit flaw. These releases show why users should continue checking for security patches even when their devices no longer receive major iOS upgrades.

Users can check for the patch in Settings > General> Software Update. Apple recommends backing up the device, connecting it to power, and using Wi-Fi before installation.

Follow Apple’s update instructions and confirm the installed version afterward. For affected devices, installing this release addresses the disclosed flaws. However, patching alone does not determine whether a device was previously compromised.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Apple Released Patches for Exploited CoreGraphics 0-day Vulnerability for Older iPhones appeared first on Cyber Security News.