On 26 October 2026 Apple released iOS 18.7.11 and iPadOS 18.7.11. The update carries the fix for CVE-2026-86950, a CoreGraphics zero-day bug. Apple says it may have been used in an attack on specific people.
Apple fixed the same bug on 28 September for newer devices. The iPhone XS, XS Max and XR and the iPad 7th generation waited another four weeks.
If you manage a fleet, those four models are the gap to close. The flaw itself is on our CVE-2026-86950 page, and older Apple zero-days are in our Apple zero-day tracker.
Last updated: 27 October 2026. We update this page if Apple revises its notes.
Which Apple Devices Got the Fix, and When?
Apple released the fix in two waves. The first was on 28 September 2026 for devices that run the 26 line. The second, on 26 October, is for four older models that stay on iOS and iPadOS 18. Apple’s release list names iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation for 18.7.11.
Apple’s security note for that update gives a longer device line that also names iPad Air 4th generation and later, iPad 9th generation and later and iPad mini 6th generation and later. Those iPads are already on the 26.7.1 list, so the four older models are the ones that depend on 18.7.11. The release list is on Apple’s security releases page.
| Update | Released | Devices |
|---|---|---|
| iOS 18.7.11 and iPadOS 18.7.11 | 26 Oct 2026 | iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation |
| iOS 26.7.1 and iPadOS 26.7.1 | 28 Sep 2026 | iPhone 11 and later; iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, iPad mini 5th generation and later |
| macOS Tahoe 26.7.1 | 28 Sep 2026 | macOS Tahoe |
| macOS Sequoia 15.8.1 | 28 Sep 2026 | macOS Sequoia |
The 26.7.1 list starts at iPhone 11 and iPad 8th generation. That is why the XS, XS Max, XR and iPad 7th generation were outside it. The same 26 October update also fixes two other bugs, one in Audio and one in CoreMedia. Apple’s note for iOS 18.7.11 says an app may be able to leak sensitive user information through the first, and a malicious app may be able to reach the camera without permission through the second.
What Does Apple Say About the Attack?
Apple’s text for CVE-2026-86950 is short. It says that “processing a maliciously crafted file may lead to arbitrary code execution”. It adds that the issue “may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” Meta Product Security is credited with the report. Apple names no app, no attacker and no victim.
CISA added the flaw to its Known Exploited Vulnerabilities catalog on 29 September 2026, with a federal due date of 13 October. The catalog lists use in ransomware campaigns as unknown. NVD shows a CVSS 3.1 score of 8.8 (High), entered by a secondary source rather than Apple. FIRST’s EPSS gave the flaw a 0.26 probability of exploitation on 26 October, in the 98th percentile.
How Does a PDF Font Reach the Bug?
Apple gives no technical detail, so the best account comes from the research team Calif. In a write-up of 30 September, Calif says it compared the code before and after the fix. A small function that turns a floating-point coordinate into a fixed-point number could overflow. A PDF with a crafted embedded font can make CoreGraphics use that function while it draws a letter.
The overflow shrinks the memory CoreGraphics sets aside for the glyph, and the drawing step then writes outside it. Calif published a PDF generator that crashes the renderer on macOS and iOS. It calls the step from crash to code execution “another exercise entirely”. It also asks researchers to take apart the in-the-wild sample.
Calif looked at recent WhatsApp changes for clues, because Meta found the bug. It says WhatsApp added checks for font data inside PDF attachments. Calif treats a WhatsApp route as possible, not proven, and Apple’s note names no app.
Is There Public Exploit Code?
- Apple wordingYes“May have been exploited in an extremely sophisticated attack against specific targeted individuals”28 Sep
- CISA KEVYesAdded 29 September 2026, federal due date 13 October, ransomware use listed as unknown29 Sep
- Public crash trigger (Calif)YesA PDF and font generator that crashes the renderer; Calif says working code execution is a separate task30 Sep
- GitHub repositoriesYes7 repositories carry the CVE id, the first created on 29 September and the latest on 20 October29 Sep to 20 Oct
- XYes72 distinct posts about the flaw from 29 September to 27 October, 20 of them on 29 September and 13 on 27 October29 Sep to 27 Oct
- Dark web chatYes66 posts in Telegram channels and on a Russian-language forum mention the CVE id; 21 of them on 29 September28 Sep to 27 Oct
Seven GitHub repositories carry the CVE id. Two are defensive: a PDF font detector and a runtime monitor whose own README says its glyph rules were not tested against attack samples from the wild.
One claims a full exploitation framework with a ROP chain and a CVSS of 9.6, which is not the score NVD shows. Two others share the same text and point to a download behind a link shortener. We did not open them, and you should treat such downloads as untrusted.
One X post that adds something comes from a researcher. On 2 October Philippe Lagadec published a detector for the crafted PDFs, described on his page for the flaw.
Lagadec says the tool parses the PDF and its fonts instead of matching bytes, so YARA rules are unlikely to work. He reports no false positives on more than 19,000 legitimate PDFs. His readme calls the tool new and asks for caution.
What Should You Do Today?
- Find the old modelsList every iPhone XS, XS Max, XR and iPad 7th generation in your device inventory or MDM.
- Install the 18.7.11 updateOn each device open Settings, General, Software Update, and install iOS 18.7.11 or iPadOS 18.7.11.
- Check the rest of the fleetiPhone 11 and later and the iPads on Apple’s 26.7.1 list need iOS or iPadOS 26.7.1 or newer. Macs need macOS Tahoe 26.7.1 or Sequoia 15.8.1 or newer.
- Set a minimum versionIf your MDM can block devices below a version, set it to the fixed build for each model.
- Handle devices that cannot updateKeep an iPhone that cannot take 18.7.11 away from sensitive mail and messaging until it is replaced.
- Treat odd PDFs as riskyDo not open PDFs from unknown senders on unpatched devices. A defender with a PDF gateway can test files with the detector above, as a second check only.
Our post on CVSS, EPSS and CISA KEV signals explains why a KEV entry with a due date outranks a high score alone. A zero-day vulnerability that Apple itself says was used against people belongs at the top of the patch queue.