Skip to content
COR Intelligence
Back to The Patch Wave
The Patch WaveThis weekFound by: people

iPhones and iPads: older models now get the fix for a flaw already used in attacks

COR Solutions27 October 2026
4 min read852 words

Apple has sent the fix for a CoreGraphics flaw already used in targeted attacks to iPhones and iPads still on iOS 18, including older models (XS, XS Max, XR, iPad 7th generation). Update them to 18.7.11 or later, and check newer devices are on the latest version.

LinkedInXEmail
An older iPhone and iPad with softly glowing screens on a sunlit wooden office desk beside a charging cable, navy mug and plants.

What happened

Apple fixed a flaw in CoreGraphics, the part of iOS that draws images and documents, back in September. A booby-trapped file could let an attacker run their own code on the device. Apple says it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals". On 26/10/2026 Apple sent the same fix to iPhones and iPads still on iOS or iPadOS 18, including older models that can't run the newer versions.

Does this affect you

If anyone in your business still uses an iPhone XS, iPhone XS Max, iPhone XR or an iPad 7th generation, for email, Teams or two-step sign-in codes, that device needs this update. Newer iPhones and iPads are covered if they are on iOS or iPadOS 27, or on 26.7.1 or later. Any iPhone or iPad still on iOS or iPadOS 18 is exposed too, newer iPads included. A Mac on macOS Sonoma or older has had no fix for this flaw.

What to do

  1. On any iPhone or iPad still on iOS or iPadOS 18, newer iPads included, go to Settings, General, Software Update: install 18.7.11 if it is offered, otherwise move up to 26.7.2 or 27.2.
  2. On newer iPhones and iPads, install the latest: 26.7.2 on iOS or iPadOS 26 (26.7.1 is the minimum for this flaw), or 27.2 on 27. On Macs, install the latest: Sequoia 15.8.2 (15.8.1 minimum), Tahoe 26.7.2 (26.7.1 minimum) or Golden Gate 27.2. The latest versions all came out on 26/10/2026.
  3. A Mac on Sonoma or older has had no fix for this: move it to Sequoia 15.8.2, Tahoe 26.7.2 or Golden Gate 27.2 if it can run one of them.
  4. If you have a device management tool, ask your IT person to check every company phone and iPad is on one of these versions this week.

Is it being attacked? Apple says it "may have been exploited" in targeted attacks, and CISA added it to its list of flaws known to be used in attacks on 29/09/2026. Researchers at Calif have published a file that triggers the flaw on iOS and macOS (GitHub, 30/09/2026). Their trigger is a PDF carrying a specially made font, so the risk is a document someone opens or previews.

How to check a device

On an iPhone or iPad, open Settings, tap General, then About, and look next to iOS Version or iPadOS Version (Apple). On a Mac, choose About This Mac from the Apple menu in the top left-hand corner (Apple).

If a device can't be updated

Apple has released no fix for this flaw for older devices. The iPhone 8, iPhone 8 Plus and iPhone X, and the iPad 5th and 6th generation, stay on iOS 16 or iPadOS 17, and their last updates came out on 11/05/2026. Macs on macOS Sonoma or older have had nothing since Sonoma 14.8.9 on 06/08/2026. The CVE record lists every iOS and iPadOS version before 18.7.11, and every macOS version before 15.8.1, as affected. Keep those devices away from work email, Teams and sign-in codes, and plan to replace them.

Found by

Apple credits Meta Product Security. Neither Apple nor the credit says anything about Ai. Tag: people.

For developers

  • CVE-2026-86950, out-of-bounds write in CoreGraphics (CWE-787). CVSS 3.1 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) from CISA's ADP entry on the CVE record; Apple publishes no score.
  • Fixed in iOS and iPadOS 18.7.11 (26/10/2026), iOS and iPadOS 26.7.1, macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1 (28/09/2026). Apple says the exploitation was "on versions of iOS before iOS 27" (https://support.apple.com/en-gb/149225). NVD and CVE.org list no iOS 27 or macOS Golden Gate version as affected.
  • CISA KEV: added 29/09/2026, federal due date 13/10/2026, known ransomware use "Unknown". No indicators of compromise in the Apple or CISA entries.
  • iOS 18.7.11 also fixes CVE-2026-65339 (Audio, app may leak sensitive information; Apple credits Mustafa Calap (@ordinal0, dbg.re) and Meta Red Team X, Nik Tsytsarkin) and CVE-2026-86990 (CoreMedia, malicious app may access the camera without permission; Apple credits Mustafa Calap (@ordinal0, dbg.re)).
  • Finder: "CVE-2026-86950: Meta Product Security" (Apple, https://support.apple.com/en-gb/149225). No write-up from the finder found. A third-party write-up and trigger: Calif, GitHub, 30/09/2026.

Sources

Read next

More from The Patch Wave