Apple has expanded fixes for an exploited high-severity flaw to older devices, shipping iOS 18.7.11 and iPadOS 18.7.11 on Monday. Tracked as CVE-2026-86950 (CVSS 8.8), the out-of-bounds write in CoreGraphics could allow arbitrary code execution when processing a maliciously crafted file, and Apple says it "may have been exploited in an extremely sophisticated attack against specific targeted individuals" on versions of iOS before iOS 27 — the same flaw first patched last month in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. The backport covers iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation and later, iPad Air 4th generation and later, and iPad mini 6th generation and later. The release also addresses an Audio logic issue (CVE-2026-65339) that could leak sensitive user information and a CoreMedia flaw (CVE-2026-86990) allowing camera access without permission. Apple simultaneously shipped iOS 27.2, macOS Golden Gate 27.2 and related releases fixing several hundred vulnerabilities, including an Apple Intelligence authorisation issue (CVE-2026-86987) exploitable by a remote attacker.

• Source article