Apple released iOS 18.7.11 and iPadOS 18.7.11 on October 26, bringing a CoreGraphics security fix to older devices. Apple’s release index lists the iPhone XS, iPhone XS Max, iPhone XR and seventh-generation iPad for these releases.

The advisory identifies CVE-2026-86950. Processing a maliciously crafted file may let an attacker run code. CoreGraphics, Apple’s graphics and image-rendering framework, could write beyond its allocated memory; Apple says it improved bounds checking.

Preserve Apple’s qualification about attacks

Evidence status: Apple reports possible exploitation against specific targeted individuals. Its wording is narrower than a confirmed widespread attack:

Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

Apple credits Meta Product Security with the finding. The advisory provides no victim count, attacker attribution or complete delivery chain. It does not establish that simply receiving any image compromises a device.

Sergiu Gatlan’s BleepingComputer report describes the update as a backport of September’s fix. Tim Hardwick’s MacRumors coverage likewise distinguishes the older-device update from this week’s newer operating-system releases.

The newly available backport is the reason to act now. The underlying flaw and possible targeted attacks predate this release.

Check the update for the device you actually have

  • On the listed older devices, install iOS or iPadOS 18.7.11. Open Settings → General → Software Update and follow Apple’s update instructions.
  • On another model, use its supported update path. Apple’s release index assigns different devices to different operating-system lines. An older branch’s new version number does not establish that your newer device can install it.
  • For managed devices, confirm the installed version after deployment. Issuing an update request and completing installation are separate steps.

Caveat: The patch closes the documented flaw; installing it does not determine whether a device was previously targeted. Apple’s public advisory leaves the attack’s scope unresolved.