Apple patches older iPhones against ‘extremely sophisticated’ attacks leveraging CoreGraphics flaw

Apple is extending protection from a previously exploited security flaw to older iPhones and iPads, including devices that can no longer run the latest versions of iOS.

Apple has released another round of security updates, this time bringing older iPhones and iPads a critical fix for a previously exploited vulnerability.

The updates, released Oct. 26, address a CoreGraphics flaw that Apple warned this month may have been exploited in highly sophisticated attacks targeting specific individuals.

The vulnerability, tracked as CVE-2026-86950, was patched in late September for newer devices running iOS 26, iPadOS 26, and supported versions of macOS.

Now, Apple is extending that protection to devices running iOS 18 and iPadOS 18, including several older iPhone models that can’t upgrade to the latest operating system.

Key points

• Apple has backported a fix for an exploited CoreGraphics zero-day to older iPhones and iPads
• The vulnerability, CVE-2026-86950, can allow malicious code execution through a specially crafted file
• Apple previously linked the flaw to extremely sophisticated attacks against specific individuals
• iOS 18.7.11 and iPadOS 18.7.11 also address vulnerabilities affecting user privacy and camera access
• Users of older Apple devices should install the latest compatible security update without delay

Older iPhones finally get the fix

Apple's latest security releases bring the CoreGraphics patch to the iPhone XS, iPhone XS Max, and iPhone XR, as well as the seventh-generation iPad.

These devices are still in use even though they can’t run newer versions of Apple's mobile operating systems.

The fix is included in iOS 18.7.11 and iPadOS 18.7.11, both released Oct. 26, according to Apple's security releases page.

The vulnerability is an out-of-bounds write issue in CoreGraphics, the framework responsible for rendering graphics and other visual content across Apple's operating systems.

In practical terms, processing a maliciously crafted file could cause a vulnerable device to execute code supplied by an attacker.

Apple addressed the issue by improving bounds checking, which helps prevent software from writing data outside its allocated memory.

The flaw, reported by Meta Product Security, carries a CVSS severity score of 8.8.

A vulnerability already linked to targeted attacks

The original advisory warned that the vulnerability may have been used in an extremely sophisticated attack against specific targets running versions of iOS predating iOS 27.

Apple has not identified the victims, disclosed who may have been behind the attacks, or explained how the malicious files were delivered.

Neither has it confirmed whether spyware was involved.

As we reported earlier this month, the circumstances suggest a highly selective operation rather than a widespread campaign targeting ordinary iPhone users.

The fact that attackers may have exploited the vulnerability before Apple issued a fix makes it particularly important for users to install the latest security updates.

Other security flaws patched

The iOS 18.7.11 and iPadOS 18.7.11 updates address two additional vulnerabilities with potential privacy implications.

One, tracked as CVE-2026-65339, affects the operating system's audio functionality and could allow an application to access sensitive user information.

Another, CVE-2026-86990, affects CoreMedia and could let a malicious application access the device's camera without the user's permission.

Apple has not indicated that either of these additional vulnerabilities has been exploited in real-world attacks.

The company has also released broader security updates for newer devices, including iOS 27.2, iPadOS 27.2, and macOS Golden Gate 27.2, addressing numerous vulnerabilities across system components.

What Apple users should do

Even though the CoreGraphics flaw appears to have been exploited in highly targeted attacks, security updates are among the simplest and most effective ways to protect against known vulnerabilities.

Owners of older iPhones and iPads should check for the latest compatible update. To update an iPhone or iPad:

1.     Open Settings

2.     Tap General

3.     Select Software Update

4.     Download and install the latest available update

Users should also enable automatic updates to help ensure important security fixes are installed promptly.

And while the attacks associated with this particular vulnerability appear to have been highly selective, users should remain cautious about unexpected files, links, and attachments, especially those received from unknown senders.

These backported patches are a reminder that older devices can remain vulnerable to serious security flaws long after newer operating systems have received fixes. For anyone still using an older iPhone or iPad, keeping the software updated is essential!

For peace of mind, use independent security software to help detect malicious links and downloads, and other threats that may accompany an attack.

On topic:

Pegasus spyware infects iPhone of Serbian university rector who supported student protests

Apple patches zero-day behind ‘extremely sophisticated’ iPhone attacks

An online ad was enough to deliver spyware—no click required