Apple’s CoreGraphics Fix Also Comes to iOS 18

Apple’s CoreGraphics fix is also available for supported iPhones and iPads running iOS and iPadOS 18. On October 26, the company released iOS 18.7.11 and iPadOS 18.7.11, which address three security flaws, including the CVE-2026-86950 vulnerability. Apple also released iOS 27.2, iPadOS 27.2, and macOS Golden Gate 27.2 with extensive security fixes.

The CVE-2026-86950 vulnerability is located in the CoreGraphics component. According to Apple, processing a malicious file could lead to arbitrary code execution. The company said it received a report of possible exploitation of the flaw in an extremely sophisticated attack against specifically targeted individuals on iOS versions before iOS 27.

Apple’s CoreGraphics fix also reaches the older branch

The release of iOS 18.7.11 and iPadOS 18.7.11 extends the fix to supported devices that are not running the latest major system version. This is an additional backport of the CVE-2026-86950 fix to the older iOS and iPadOS branch.

Apple has not publicly described the technical mechanism of the attack or stated who was behind the attacks, whom they affected, or the extent to which the flaw was used. The company’s wording refers to a report of possible exploitation in a targeted attack; it is therefore not public confirmation of a mass campaign or a complete attack chain.

For users of supported iOS 18 versions, the key point is that the fix is not limited to iOS 27. According to the security bulletin, update 18.7.11 addresses three flaws in total, with CVE-2026-86950 being the one for which Apple reports possible exploitation.

New systems fix an extensive list of flaws

The security bulletins for iOS 27.2, iPadOS 27.2, and macOS Golden Gate 27.2 contain extensive lists of fixes across system components. The scenarios addressed include possible code execution, data leakage, sandbox escape, and privilege escalation.

Apple does not provide one consolidated number of fixed vulnerabilities across the new releases in its own bulletins. After counting the entries, SecurityWeek reported 286 unique vulnerabilities in iOS/iPadOS 27.2 and macOS 27.2. This number is the publication’s calculation, not a separately stated figure from Apple.

The scope of the fixes in the new versions does not mean that all flaws were publicly exploited. In the security information provided, Apple links the specific CVE-2026-86950 to possible targeted exploitation. For the other entries, the bulletins describe the type of potential impact and the affected components.

What users and administrators should do

iPhone and iPad users on the supported iOS 18 branch should deploy iOS or iPadOS 18.7.11. Devices on the current branch should receive iOS or iPadOS 27.2. For Macs, Apple released macOS Golden Gate 27.2.

In organizations, it will be important to monitor deployment of all three updates, especially on devices that remain on iOS 18. Further details about CVE-2026-86950 are not publicly available at this time. It is therefore necessary to monitor whether Apple, Meta Product Security, or other trusted sources publish technical details, indicators of compromise, or more specific recommendations regarding the attacks the company described as targeted.

Verified and updated: October 27, 2026, 15:19