Apple released iOS 18.7.11 and iPadOS 18.7.11 to patch a previously exploited CoreGraphics vulnerability on older devices, including the iPhone XS, XS Max, and XR.
The updates address three vulnerabilities, including a separate flaw that could let a malicious app access the camera without permission.
The most significant fix concerns CVE-2026-86950, an out-of-bounds write vulnerability reported by Meta Product Security. Processing a specially crafted file could trigger the flaw and allow arbitrary code execution. Apple addressed it by improving bounds checking.
CoreGraphics is a system framework used to draw and process graphics across Apple’s operating systems. A vulnerability in this component can expose devices through files handled by software that uses the framework, although Apple has not identified the file format involved in this case.
Apple says it is aware of a report that the vulnerability may have been exploited in an “extremely sophisticated attack” against specific individuals running versions of iOS before iOS 27.
Apple previously patched the issue in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. The latest release extends that protection to devices covered by the older iOS and iPadOS 18 branch.
The advisory repeats Apple’s earlier exploitation warning without adding attack details. It does not identify the targets, explain how the malicious files reached them, or establish that these older iPhone models were specifically attacked.
The other two fixes address privacy risks. CVE-2026-86990, an access-control issue in CoreMedia reported by Mustafa Calap, could allow a malicious app to use the camera without user permission. Apple tightened access restrictions to resolve it.
Meanwhile, CVE-2026-65339, an Audio logic flaw, could allow an app to leak sensitive user information. Apple credits Calap and Meta Red Team X researcher Nik Tsytsarkin with reporting the issue and says it added improved checks.
Security fixes for newer releases
Apple also released iOS 27.2 and iPadOS 27.2, alongside iOS 26.7.2 and iPadOS 26.7.2, with broader collections of security fixes for supported devices.
Among the notable issues addressed in both branches is CVE-2026-112690, listed under App Store, which could allow a remote attacker to escape the WebContent sandbox. Reported by Cisco Talos researchers, the flaw affects a security boundary designed to contain web content.
Both branches also fix CVE-2026-84495, a kernel use-after-free vulnerability reported by Wang Yu that could allow an app to write to kernel memory or crash the system.
Users should open Settings > General > Software Update and install the latest release offered for their device.
Leave a Reply