Apple Patches iPhone XR and XS for Exploited CoreGraphics Flaw 28 Days After Newer iPhones Got the Fix

Apple shipped iOS 18.7.11 and iPadOS 18.7.11 on Oct. 26, 2026, carrying a fix for CVE-2026-86950, a CoreGraphics out-of-bounds write that Apple says may have been exploited in an extremely sophisticated attack against specific targeted individuals. The iPhones that need it are the iPhone XS, iPhone XS Max and iPhone XR, plus the 7th-generation iPad, according to Apple's releases page.

The newer iOS 26 branch received the same fix in iOS 26.7.1 on Sept. 28, so the older devices waited 28 days. The mitigation is to install the update; Apple lists no workaround.

What the advisory says

Apple's security advisory describes the impact as arbitrary code execution after processing a maliciously crafted file, and the fix as improved bounds checking. It credits Meta Product Security with the report. The exploitation wording is Apple's: "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27."

Apple does not say who exploited it, which victims were targeted, or when exploitation began. It does not give a CVSS score. BleepingComputer, which reported the backport on Oct. 27, listed the original September fixes as iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.

Which devices got which fix

Release	Date	Devices
iOS 26.7.1	Sept. 28, 2026	iPhone 11 and later, plus several iPads
iOS 18.7.11	Oct. 26, 2026	iPhone XS, XS Max, XR; iPad 7th generation

The split follows Apple's support cut-off. iOS 26.7.1 is listed for the iPhone 11 and later, so the XS, XS Max and XR cannot take it and stay on the iOS 18 line. Apple's advisory page also lists wider iPad sets for the backport, including iPad Air 4th generation and later and iPad mini 6th generation and later, but the page runs the device names together without separators, and the releases page names only the 7th-generation iPad. Check the advisory against your own model.

The same day Apple published iOS 27.2, iOS 26.7.2, macOS 27.2 and Safari 27.2, according to the releases page. That page lists no CVEs against the iOS 18.7.11 entry itself; the CVE comes from the separate advisory.

Why the 28 days matter

The exploitation clause covers iOS before iOS 27, and devices on iOS 18 sit inside it. For those 28 days a published fix existed for one branch while XS and XR owners had none. Apple has not said whether any exploitation touched those devices, and nothing in the advisory says so.

BleepingComputer lists CVE-2026-20700 as another 2026 Apple zero-day: an arbitrary-code-execution flaw in dyld that Apple described in the same "extremely sophisticated" terms and patched in February. Apple's wording limits both to targeted individuals, which puts the risk to a typical user low, and the cost of installing the update is a restart.

Other vendors had worse sequencing this month. Node.js's October release included four fixes that followed earlier patches that did not hold, and Amazon saw PHP2Shell exploit attempts four days before PHP shipped its fix.

To check a device, open Settings, General, Software Update, and confirm it reads iOS 18.7.11 on an XS, XS Max or XR. Apple has not said whether more backports to the iOS 18 line are due.