Apple on Monday released iOS 18.7.11 and iPadOS 18.7.11 for older iPhones and iPads, including a CoreGraphics patch for CVE-2026-86950, a flaw the company said may have been used in targeted attacks^1,2.

The bulletin lists the update as available for iPhone XS, iPhone XS Max, iPhone XR, iPad (7th generation), iPad Air (4th generation and later), iPad (9th generation and later), and iPad mini (6th generation and later)².

Apple described an out-of-bounds write in CoreGraphics that was addressed with improved bounds checking². The company said processing a maliciously crafted file may lead to arbitrary code execution².

BleepingComputer, citing Apple, reported that the same vulnerability had already been patched in September on newer software branches, including iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1¹. Apple's Monday document does not restate those earlier version numbers².

Apple said it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27^1,2. It did not name victims, operators or how widely the bug was used².

Meta Product Security is credited on the CoreGraphics entry^1,2. BleepingComputer noted that out-of-bounds writes can crash software, corrupt data or enable remote code execution if an attacker writes outside an allocated buffer¹.

The same iOS 18.7.11 bulletin also lists CVE-2026-65339 in Audio, described as a logic issue that could let an app leak sensitive user information, and CVE-2026-86990 in CoreMedia, described as an access issue that could let a malicious app use the camera without permission². Apple did not say those two bugs were exploited².

BleepingComputer said CVE-2026-86950 is the second zero-day Apple has patched this year after a dyld flaw, CVE-2026-20700, that was fixed in February and also described as used in extremely sophisticated targeted attacks¹. That earlier case is not part of Monday's bulletin².

Apple did not publish exploit samples or say whether remaining unpatched devices remain in active targeting². Users of the listed older models can install iOS 18.7.11 or iPadOS 18.7.11 through the device software-update settings².