Apple Patches Exploited CoreGraphics Zero-Day CVE-2026-86950 on iPhone XS and XR

Owners of the iPhone XS, XS Max, XR and the 7th-generation iPad can now close CVE-2026-86950, a CoreGraphics flaw that lets a crafted file run code. Apple says it may have been exploited. Apple shipped the fix for those devices in iOS and iPadOS 18.7.11 on 26 October, a month after newer iPhones got it.

The flaw

It's an out-of-bounds write in CoreGraphics. Apple says it is "aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27". The bug was reported by Meta Product Security.

CISA added it to the Known Exploited Vulnerabilities catalogue on 29 September.

A public exploit since September

Researchers at the security firm Calif diffed the September update and published a working proof of concept on 30 September, two days after the patch. The bug sits in the glyph rasteriser. A PDF with a crafted embedded font reaches it.

Calif also suspects a zero-click route through WhatsApp, pointing to stricter PDF font checks WhatsApp added in the same window. Apple and Meta haven't confirmed how the attack was delivered.

Singapore advisory

Singapore's Cyber Security Agency warned about the flaw in alert AL-2026-130 on 30 September; that alert lists the September versions and hasn't been revised for 18.7.11.

Which update you need

• iPhone XS, XS Max, XR and iPad 7th generation: iOS or iPadOS 18.7.11. The same release fixes an audio data leak and a CoreMedia camera-access flaw.
• iPhone 11 and later, and supported iPads: iOS or iPadOS 26.7.1 from 28 September.
• Macs: macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1.