Article
iOS 18.7.11: Fix for the Exploited CoreGraphics Bug Reaches iPhone XS, XS Max and XR
Apple's iOS 18.7.11 fixes CVE-2026-86950, a CoreGraphics bug Apple says may have been exploited, on iPhone XS, XS Max, XR and iPad 7th gen.
Read more
Exploited vulnerability
Apple CoreGraphics out-of-bounds write (CVE-2026-86950)
An out-of-bounds write (CWE-787) in Apple CoreGraphics.
- On CISA KEV
- CVE ID
- CVE-2026-86950
- CVSS
- 8.8 High (CVSS 3.1, NVD secondary source)
- CISA KEV
- Listed
- Affected product
- iOS, iPadOS and macOS (CoreGraphics)
- Exploited
- Yes
- Published
- 28 September 2026 (Apple fix and NVD record); 26 October 2026 (iOS 18.7.11)
In short
CVE-2026-86950 is an out-of-bounds write (CWE-787) in Apple CoreGraphics. Apple says processing a crafted file may lead to arbitrary code execution and that it may have been exploited in an attack on specific people. Fixed in iOS and iPadOS 26.7.1 and 18.7.11, macOS 26.7.1 and 15.8.1.
- CVECVE-2026-86950
- ProductApple iOS, iPadOS and macOS (CoreGraphics)
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedFind the models · Install the update
What it allows
Apple describes CVE-2026-86950 as an out-of-bounds write in CoreGraphics. Its note says that processing a maliciously crafted file may lead to arbitrary code execution. Apple fixed it with improved bounds checking and credits Meta Product Security.
Apple adds that the issue "may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27."
Calif, a security research team, analysed the fix and published a write-up on 30 September 2026. It places the bug in the CoreGraphics code that draws smoothed shapes. A function that turns a floating-point coordinate into a fixed-point number could overflow.
A PDF with a crafted embedded font can drive the renderer into that function. The renderer then sets aside too little memory and writes past it.
Calif says that turning this crash into code execution is a separate job, and its published PDF only crashes the renderer. Apple names no app or delivery route.
What Our Checks Showed
Exploit signals
- CISA KEVYesAdded 29 September 2026, federal due date 13 October, ransomware use listed as unknown29 Sep
- Public crash triggerYesCalif published a PDF and font generator that crashes the renderer on macOS and iOS30 Sep
- GitHubYes7 repositories carry the CVE id, first created 29 September, latest 20 October. Two are defensive tools; others make exploit claims we did not verify29 Sep to 20 Oct
- XYes72 distinct posts about the flaw from 29 September to 27 October; a researcher published a detector on 2 October29 Sep to 27 Oct
- Dark web chatYes66 posts in Telegram channels and on a Russian-language forum mention the CVE id; 21 on 29 September28 Sep to 27 Oct
Verdict Exploited per CISA KEV (Apple: may have been), public crash trigger and detector
NVD lists a CVSS 3.1 base score of 8.8 (High) from a secondary source. Its CISA-supplied data marks exploitation as active. FIRST's EPSS shows a 0.26 probability on 26 October, in the 98th percentile.
Our news post on iOS 18.7.11 covers the 26 October update for older iPhones. Earlier Apple zero-days are in the Apple zero-day tracker.
Who is affected
Apple fixed the flaw in iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 on 28 September 2026. On 26 October 2026 it added iOS 18.7.11 and iPadOS 18.7.11. NVD lists affected versions as anything below 18.7.11 and 26.7.1 for iOS and iPadOS, and below 15.8.1 and 26.7.1 for macOS.
Apple's release list names iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation for 18.7.11. The 26.7.1 update covers these devices:
- iPhone 11 and later
- iPad Pro 12.9-inch 3rd generation and later
- iPad Pro 11-inch 1st generation and later
- iPad Air 3rd generation and later
- iPad 8th generation and later
- iPad mini 5th generation and later
The 18.7.11 security note also names iPad Air 4th generation and later, iPad 9th generation and later and iPad mini 6th generation and later. Those iPads are already on the 26.7.1 list. The release list is on the Apple security releases page.
Apple says the issue may have been exploited on versions of iOS before iOS 27.
Timeline
- 28 Sep 2026
Apple releases iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 with the CoreGraphics fix. NVD publishes the CVE record at 20:17 UTC.
- 29 Sep 2026
CISA adds the flaw to the Known Exploited Vulnerabilities catalog, with a due date of 13 October.
- 30 Sep 2026
Calif publishes its write-up and a PDF generator that crashes the renderer.
- 2 Oct 2026
Philippe Lagadec publishes a Python detector for PDFs with crafted fonts.
- 26 Oct 2026
Apple releases iOS 18.7.11 and iPadOS 18.7.11 for iPhone XS, XS Max, XR and iPad 7th generation, with the same fix.
What to do
-
Find the models
List iPhone XS, XS Max, XR and iPad 7th generation devices, plus anything still on iOS or iPadOS below 26.7.1, in your inventory or MDM.
-
Install the update
Use iOS or iPadOS 18.7.11 for the four older models, and 26.7.1 or newer for the rest. Mac users need macOS Tahoe 26.7.1 or Sequoia 15.8.1 or newer.
-
Set a minimum version
If your MDM can enforce one, block access to mail and corporate apps for devices below the fixed build.
-
Be careful with PDFs
Until a device is updated, do not open PDFs from unknown senders on it. Calif traced the bug to crafted fonts inside PDFs.
-
Use the detector as a second check
Philippe Lagadec's open tool parses the fonts inside a PDF and checks the glyphs for the traits of the exploit. His readme calls it new and asks for caution, so do not rely on it alone.
Questions
Which versions fix CVE-2026-86950?
Apple lists iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1.
Is CVE-2026-86950 exploited?
Apple says it may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. CISA added it to the KEV catalog on 29 September 2026.
What does the flaw let an attacker do?
Apple says processing a maliciously crafted file may lead to arbitrary code execution. Calif shows that a PDF with a crafted font reaches the bug and crashes the renderer.
Does the iPhone XS need a separate update?
Yes. The iPhone XS, XS Max and XR are outside the 26.7.1 list. Apple fixed them in iOS 18.7.11 on 26 October 2026.
Is there public exploit code?
Calif published a PDF generator that crashes the renderer. Calif says working code execution is a separate task. Several GitHub repositories carry the CVE id and make claims that we did not verify.
In our research
Sources
- About the security content of iOS 18.7.11 and iPadOS 18.7.11 Apple
- About the security content of iOS 26.7.1 and iPadOS 26.7.1 Apple
- About the security content of macOS Sequoia 15.8.1 Apple
- CVE-2026-86950 NVD
- Known Exploited Vulnerabilities catalog CISA
- CVE-2026-86950: The Great Glyph Grift Calif
- CVE-2026-86950 PDF exploit detector Philippe Lagadec
- CWE-787: Out-of-bounds Write MITRE
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 27 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 59 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 79 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.