Cybersecurity
Apple backports CoreGraphics fix to older iPhones and iPads
Apple expanded its fix for CVE-2026-86950 to iOS 18.7.11 and iPadOS 18.7.11 after saying the CoreGraphics flaw may have been used against targeted individuals on earlier iOS versions.
- Apple backported fixes for CVE-2026-86950 to iOS 18.7.11 and iPadOS 18.7.11 on Monday.
- Apple had already released patches for the same flaw in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
- Apple said the CoreGraphics issue may have been used in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
- The new iOS 18.7.11 and iPadOS 18.7.11 releases also fixed issues in Audio and CoreMedia.
- Apple also shipped iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2, visionOS 27.2 and Safari 27.2 with hundreds of other fixes.
Apple said it had broadened fixes for CVE-2026-86950 to older iPhones and iPads. The flaw was in CoreGraphics and could allow arbitrary code to run when a malicious file was processed.
The company had already patched the issue in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Apple said at the time that the flaw may have been used in highly advanced attacks against specific people on devices running iOS before iOS 27.
The new releases were iOS 18.7.11 and iPadOS 18.7.11. Apple said they supported iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
Apple said those updates also fixed a logic problem in Audio and an access issue in CoreMedia. It said the Audio issue could let an app expose sensitive user data, while the CoreMedia issue could let a malicious app use the camera without permission.
Apple also released iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2, visionOS 27.2 and Safari 27.2. Those updates covered hundreds of flaws, including one in Apple Intelligence that Apple said it addressed with improved entitlement checks.
Named in this story
Companies
- Apple
- backported the fixes and described how the flaw may have been used
Products and systems
- CoreGraphics
- the Apple framework affected by the out-of-bounds write
- iOS 18.7.11
- one of the new backport releases for older iPhones
- iPadOS 18.7.11
- one of the new backport releases for older iPads
- iOS 26.7.1
- one of the earlier versions that first received the patch
- iPadOS 26.7.1
- one of the earlier versions that first received the patch
- macOS Tahoe 26.7.1
- one of the earlier versions that first received the patch
- macOS Sequoia 15.8.1
- one of the earlier versions that first received the patch
- Audio
- had a logic issue fixed in the same backport releases
- CoreMedia
- had an access issue fixed in the same backport releases
- Apple Intelligence
- had an authorisation issue fixed in the broader update set
- iOS 27.2
- one of Apple's broader platform releases with many fixes
- iPadOS 27.2
- one of Apple's broader platform releases with many fixes
- macOS Golden Gate 27.2
- one of Apple's broader platform releases with many fixes
- tvOS 27.2
- one of Apple's broader platform releases with many fixes
- watchOS 27.2
- one of Apple's broader platform releases with many fixes
- visionOS 27.2
- one of Apple's broader platform releases with many fixes
- Safari 27.2
- one of Apple's broader platform releases with many fixes
How the source tells it
The piece was mostly a plain security update report, with mild urgency from repeated exploitation warnings and the closing advice to update devices.
- urgency repeated references to exploitation and a closing prompt to install the latest software
- threat severity labels and attack language around the CoreGraphics flaw and targeted victims