Apple released iOS 18.7.11 and iPadOS 18.7.11 on October 26, 2026, with security fixes for Audio, CoreGraphics, and CoreMedia. Apple says a CoreGraphics flaw may have been exploited in a highly sophisticated, targeted attack, and its notice lists the iPhones and iPads covered by the fixes.
What the three security fixes address
Apple lists three vulnerabilities, each with a distinct potential impact. A CVE is an identifier assigned to a publicly cataloged security flaw.
| Component | CVE identifier | Potential impact described by Apple | Apple’s stated remedy |
| Audio | CVE-2026-65339 | An app may leak sensitive user information. | Improved checks address a logic issue. |
| CoreGraphics | CVE-2026-86950 | Processing a maliciously crafted file may lead to arbitrary code execution. | Improved bounds checking addresses an out-of-bounds write, a flaw in which software writes beyond the memory area assigned to an operation. |
| CoreMedia | CVE-2026-86990 | A malicious app may access the camera without user permission. | Improved access restrictions address an access issue. |
Apple’s security notice dates the releases to October 26, 2026, and describes the three issues and remedies. The CoreGraphics entry draws particular attention because Apple says it is aware of a report of possible exploitation.
Which iPhones and iPads Apple lists
Apple lists iPhone XS, iPhone XS Max, and iPhone XR. Its iPad ranges are iPad (7th generation), iPad Air (4th generation and later), iPad (9th generation and later), and iPad mini (6th generation and later).
NeoTeo’s earlier report on the iOS 26.7.1 CoreGraphics patch covered CVE-2026-86950 in a separate software release. The iOS 18.7.11 and iPadOS 18.7.11 notice also covers the Audio and CoreMedia issues listed above.
SimpleAlpaca discusses iOS 18.7.11 on an iPhone XR in the video, describing it as a bug-fix update and recommending it to owners of older devices. That is the presenter’s commentary; Apple’s notice details the security fixes.
What Apple says about possible exploitation
Apple says it is aware of a report that CVE-2026-86950 may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27. Apple describes a reported possibility, rather than stating that exploitation occurred.
Where to check for the update
MacRumors reported on October 27, 2026, that iPhone and iPad owners could check for the updates under Settings → General → Software Update. That was the availability and settings-path information in its report on that date.
