Monday's iOS 18.7.11 backports a CoreGraphics fix to older iPhones

Apple shipped iOS 18.7.11 and iPadOS 18.7.11 on Monday to carry a patch that first landed last month on current hardware: CVE-2026-86950, an out-of-bounds write in CoreGraphics rated CVSS 8.8. A maliciously crafted file can trigger arbitrary code execution through it, and Apple says the bug may already have been used in attacks.

The original fix went out in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. Apple’s wording on the exploitation is precise: it is “aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.”

The backport extends the fix to the iOS and iPadOS 18.7 branch. iOS 18.7.11 and iPadOS 18.7.11 cover the iPhone XS, XS Max, and XR, the iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.

CoreGraphics parses images and documents, a surface reached by almost anything that renders one, which is why a memory-corruption bug there is worth having for an attacker. The backport brings the fix to users who kept XS and XR-era phones in service.

The same 18.7.11 update carries two more fixes. CVE-2026-65339 is a logic issue in Audio that could let an app leak sensitive user information. CVE-2026-86990 is an access flaw in CoreMedia that could let a malicious app reach the camera without permission. Apple does not say either was exploited.

Separately, Apple pushed the 27.2 train across the board: iOS, iPadOS, macOS Golden Gate, tvOS, watchOS, visionOS, and Safari, closing hundreds of vulnerabilities across AppleAVD, CoreAudio, ImageIO, kernel, Model I/O, Screen Sharing Server, Spotlight, StorageKit, and WebKit. One of them is CVE-2026-86987, an authorization issue in Apple Intelligence that a remote attacker could use to reach sensitive user data; Apple says it fixed that with improved entitlement checks. None of the 27.2 fixes are flagged as exploited.

If you run a fleet, the 18.x branch is the one to move on. Anything held back on iOS or iPadOS 18 for hardware reasons should go to 18.7.11 now, because the CoreGraphics bug is the one with in-the-wild exploitation attached.