Apple iOS and iPadOS: CoreGraphics out-of-bounds write (CVE-2026-86950) fixed in 18.7.11, reported exploited
Published 02/11/2026 02:20
Timeline
2 events over 9 d
- 23/10/2026 12:22ConfirmedBSI CERT-Bund (WID)+9 d
- 02/11/2026 02:20Published on WatchtowerPro CISO
In short
Apple has released iOS 18.7.11 and iPadOS 18.7.11 to fix CVE-2026-86950, an out-of-bounds write in CoreGraphics. Apple says it is aware of a report that the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals. Older iPhones and iPads should be updated now.
How bad is it
Critical. An attacker who gets a vulnerable iPhone or iPad to process a booby-trapped file can run their own code on the device, and Apple says it was used against targeted individuals.
Being exploited - on CISA's known-exploited list since 29/09/2026.
Severity score
CVSS 3.1 from NVD, from the vendor, read 02/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickYes
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- iOS and iPadOS before 18.7.11 (fix covers iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation).
- CERT-FR lists iOS and iPadOS before 18.7.11, before 26.7.2 and before 27.2 as affected, along with macOS, Safari, tvOS, visionOS and watchOS. This is CERT-FR's grouping of several Apple bulletins, not a per-CVE list.
Fixed in
- 18.7 branch: 18.7.11
What to do now
- Update affected iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation to iOS/iPadOS 18.7.11 now.
- Apple has published no workaround for this flaw.
- Until the update is installed, tell users not to open unexpected files or attachments on those devices. This reduces exposure and does not make a device safe.
- Use mobile device management (MDM) to report OS versions and set a deadline for the update.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 7 sources with their dates. And technology matching: which of your systems run iOS 18.7.11 and iPadOS 18.7.11, at which version, fixed or not - and what each one needs.
Main sources
About the security content of iOS 18.7.11 and iPadOS 18.7.11 - Apple Support Vendor · [UPDATE] [hoch] Apple iOS, iPadOS, macOS Tahoe, macOS Golden Gate, macOS Sequoia und Safari: Mehrere Schwachstellen CERT · Multiples vulnérabilités dans les produits Apple (27 octobre 2026) CERT