iOS 18.7.11 brings Apple's CoreGraphics zero-day fix to iPhone XS, XS Max and XR
Apple released iOS 18.7.11 and iPadOS 18.7.11 on Monday, October 26, with a fix for a CoreGraphics flaw that it says may have been used in targeted attacks. Newer iPhones got the same patch a month ago, so this update closes the gap for the iPhone XS, iPhone XS Max and iPhone XR, which Apple's newer iOS versions don't support.
The flaw Apple is fixing
The bug, CVE-2026-86950, is an out-of-bounds write in CoreGraphics, a graphics component of iOS. Apple says processing a maliciously crafted file may lead to arbitrary code execution, which means an attacker could run their own code on the device.
Apple says it "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." It credits Meta Product Security with reporting the flaw. Apple hasn't said who was targeted or who was behind the attacks.
Why older iPhones got it a month later
Apple first fixed CVE-2026-86950 in iOS 26.7.1 and iPadOS 26.7.1 on September 28. That release covered the iPhone 11 and later and the iPads that run iPadOS 26. Phones still on iOS 18 had no fix until now.
iOS 18.7.11 and iPadOS 18.7.11 are available for these devices:
- iPhone XS, iPhone XS Max and iPhone XR
- iPad (7th generation)
- iPad Air (4th generation and later), iPad (9th generation and later) and iPad mini (6th generation and later)
The iPads in the last group also run newer versions of iPadOS. iPadOS 18.7.11 gives owners who stayed on iPadOS 18 the same protection.
Two more fixes in the update
The update also patches two flaws that Apple doesn't list as exploited. CVE-2026-86990 is an access issue in CoreMedia that Apple says could let a malicious app use the camera without the user's permission. CVE-2026-65339 is a logic issue in the Audio component that could let an app leak sensitive user information.
That makes iOS 18.7.11 a small release next to iOS 26.7.2, which Apple shipped the same day with more than 100 security fixes.
What it means for you
If you still use an iPhone XS, iPhone XS Max or iPhone XR, install iOS 18.7.11 now. Apple's iOS 26 and iOS 27 updates list only the iPhone 11 and later, so this update is how these phones get the fix. The same goes for an iPad (7th generation) and for any newer iPad still on iPadOS 18.
To update, open Settings, tap General, then tap Software Update. Apple suggests backing up first and keeping the device plugged in and on Wi-Fi while it installs.
If your iPhone runs iOS 26, you already have this fix if you're on iOS 26.7.1 or later. Apple's warning covers attacks on versions before iOS 27, and iOS 27.2, released the same day, brings its own security fixes.