Apple's iOS 18 fix for a CoreGraphics flaw it says may have been exploited came 28 days after iOS 26's

286 CVEs in the 27.2 releases, and none carries Apple's exploitation sentence

Apple's security pages for iOS 27.2 and macOS Golden Gate 27.2, both dated 26 October 2026, list 286 distinct CVE identifiers between them. The iOS page lists 163, the macOS page 263, and 140 appear on both (derived: 163 + 263 - 140 = 286). That is the figure SecurityWeek reports. None of the 286 carries Apple's wording that a flaw may have been exploited. The one flaw that does, CVE-2026-86950 in CoreGraphics, sits on a different page: iOS 18.7.11 and iPadOS 18.7.11, which lists three CVEs. Apple fixed the same flaw on 28 September in iOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. The iOS 18 fix arrived 28 days later (derived).

What those numbers do not establish: that 286 bugs were being attacked (one flaw carries Apple's exploitation wording, which is 0.3 per cent of 286, derived); that any iPhone on iOS 18 was attacked (Apple's wording says only "versions of iOS before iOS 27"); who exploited it; or how many people were targeted. The headline pairing of a big count with an exploited flaw is two separate facts on separate pages.

This briefing reads Apple's own pages, the CVE record and the CISA Known Exploited Vulnerabilities file, not the press coverage. SecurityWeek (article) and BleepingComputer (article) were read as pointers and for what they claim. Apple's pages were read in full from 14:13 GMT on Tuesday 27 October 2026 and read again at 14:24 GMT. No form was filled in and nothing was downloaded other than pages. Earlier briefings on this CVE are linked below and are not repeated: the exploitation sentence and the public crash test. The first of those said no older line had a fix. For the iOS 18 line that is now out of date, and this briefing is the update.

How the 286 is built, and where the exploited flaw sits

Each count below is this site's own, made by reading every Apple page saved from the primary and counting distinct CVE identifiers. The pages group fixes by component, so the number of entries is not the number of CVEs. Apple's wording about exploitation was searched for in every page.

The figures for the two 27.2 pages, and for the 26.7.2, macOS 26.7.2, macOS 15.8.2, tvOS, watchOS, visionOS and Safari pages, match the ones SecurityWeek prints. SecurityWeek's "roughly 140" shared between iOS and macOS is exactly 140 on this count. Two more derived figures: the ten pages dated 26 October list 1,265 CVE lines in all, and only 329 of them are distinct, because the same CVE appears on several pages. Adding tvOS, watchOS, visionOS and Safari to the two 27.2 pages gives 288 distinct CVEs, only two more than 286. So "286" is a count of identifiers across two operating systems, not a count of attacks, and not a count of the CVEs Apple fixed that day.

On the 163 for iOS 27.2, this site counted nine CVEs whose stated impact includes arbitrary code execution, 22 that mention the kernel and 23 that mention access to sensitive user data (all derived from the Impact lines; one CVE can be counted in more than one group). Apple states no exploitation for any of them. They are listed to show what kind of fixes the 286 include, not to rank them.

What Apple, the CVE record and CISA each say about CVE-2026-86950

Apple's iOS 18.7.11 page lists the entry under CoreGraphics with the impact "Processing a maliciously crafted file may lead to arbitrary code execution". It then says Apple "is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27". The description is "An out-of-bounds write issue was addressed with improved bounds checking", and the credit is to Meta Product Security. The credit says who found the bug. It does not say who reported the exploitation, which Apple attributes only to "a report". The credit names a team inside Meta; the record states no link between the flaw and any Meta product or service.

Zoom

The CVE record, published by Apple as the CVE Numbering Authority, gives these dates: reserved 8 September 2026, published 28 September, last updated 26 October at 20:35 UTC (record). The record now names the iOS 18.7.11 build: its affected ranges read iOS and iPadOS from version 0 up to but not including 18.7.11 and up to but not including 26.7.1, and macOS up to but not including 15.8.1 and 26.7.1. The CVSS 3.1 base score of 8.8 (vector AV:N/AC:L/PR:N/UI:R) and the weakness class CWE-787 are not Apple's. They sit in the record's CISA ADP container, so CISA assigned them. The same container records CISA's SSVC value for exploitation as "active", and the KEV date added as 2026-09-29.

CISA's KEV file, read on 27 October (catalogue 2026.10.26), lists the CVE as "Apple Multiple Products Out-of-Bounds Write Vulnerability", added 29 September with a due date of 13 October, ransomware use "Unknown" and forensic triage "No" (file). Its notes cite Apple's 26.7.1, Tahoe and Sequoia pages. They do not cite the iOS 18.7.11 page. The due date binds US federal civilian agencies under BOD 26-04, which says remediation may be done by patching, decommissioning or another action; anyone else can read it as a priority signal. Our earlier briefing on the public crash test recorded a due date of 2 October in its readings on 29 September and 1 October. The file now says 13 October, and the file does not say when or why it changed.

28 days, and 13 days past the KEV due date

The dates are all on the record: reserved 8 September, fixed on 28 September, listed in KEV on 29 September, due 13 October, and fixed on the iOS 18 line on 26 October. From 28 September to 26 October is 28 days (derived). From the KEV due date of 13 October to 26 October is 13 days (derived), so a federal agency holding an iPhone XS, XS Max or XR could not meet the due date by patching: no build with the fix existed for that model. Our earlier briefing on the public crash test recorded that Calif published a crash test for this CVE on 30 September. That is 26 days before the iOS 18.7.11 date (derived); it is that briefing's finding, not something read again here, and the test did not show code execution.

Zoom

Which device got which fix, and which has none listed

"Backported to iOS 18" covers less than it sounds. Apple's release list names four devices for iOS 18.7.11 and iPadOS 18.7.11: iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation. Apple's iOS 26.7.1 list starts at iPhone 11 and iPad 8th generation. So for these four, the iOS 18 line is the only line Apple lists a fix on (derived from the two availability lists).

Zoom

One detail on the page needs care. In the iOS 18.7.11 advisory, the "Available for" line of every entry reads "iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generationAir 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later". The words run together at "generationAir". The second half matches wording on Apple's 27.2 pages, so it looks like text pasted from a longer list. Apple's release list, which is the cleaner source, names only the four devices. BleepingComputer repeats the longer wording as the list of devices that now have the fix. The record does not settle which Apple meant. Whichever it is, the newer iPads in that second half can already take 26.7.1 or later, so they are not the group that waited.

Four labels doing the work of evidence

A label, alarming or comforting, is not a measurement. Four appear in the coverage of this release.

SecurityWeek also writes that iOS and macOS 27 "do not appear to be affected". That is its reading. Apple's page limits its sentence to iOS before iOS 27 and lists no 27 entry; the CVE record lists no 27 build as affected. None of that is Apple saying 27 is unaffected.

Stated and not stated

"Not stated" means not found in any page read, in full. It does not mean the information does not exist.

Technical details

Apple, the CVE record and CISA print no indicators of compromise, no hashes, no file names, no network addresses and no detection rule for this flaw, and no proof of concept is reproduced here. What the primaries do print is the advisory entries, the record fields and the KEV entry, copied below exactly from the saved pages. Researcher credits on other Apple entries are not reproduced; the credit on these entries is a company team.

The first block is the iOS 18.7.11 entry as Apple printed it. A defender uses it to see which build carries the fix and to match the exact sentence in a ticket or asset record. The stray text in the Available for line is Apple's, not a transcription error.

CoreGraphics
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generationAir 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later
Impact: Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-86950: Meta Product Security

The second block is the first fix, on iOS 26.7.1 and iPadOS 26.7.1, released on 28 September. The Available for line here is clean and starts at iPhone 11. A defender compares it with the block above to see which models are on which path.

CoreGraphics
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later
Impact: Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-86950: Meta Product Security

The third block is selected fields of the CVE record. It shows the dates, the affected ranges and the content of the CISA ADP container. The score, weakness class and SSVC values belong to CISA's container (CISA ADP), not to Apple. A defender uses the ranges to build a version query.

cveId: CVE-2026-86950
assigner: apple
dateReserved: 2026-09-08T16:43:41.881Z
datePublished: 2026-09-28T19:13:52.603Z
dateUpdated: 2026-10-26T20:35:08.412Z
affected, iOS and iPadOS: version 0, lessThan 18.7.11; version 0, lessThan 26.7.1
affected, macOS: version 0, lessThan 15.8.1; version 0, lessThan 26.7.1
references: https://support.apple.com/en-us/149225, https://support.apple.com/en-us/149226, https://support.apple.com/en-us/149228, https://support.apple.com/en-us/149229
ADP (CISA-ADP) problem type: CWE-787 Out-of-bounds Write
ADP CVSS 3.1: 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ADP SSVC: Exploitation active; Automatable no; Technical Impact total (timestamp 2026-09-30T03:55:58.823862Z)
ADP kev dateAdded: 2026-09-29

The fourth block is the CISA KEV entry. The required action text and due date set the clock for US federal civilian agencies; the notes field is where CISA lists the vendor pages it relies on, and it does not list the iOS 18.7.11 page.

cveID: CVE-2026-86950
vendorProject: Apple
product: Multiple Products
vulnerabilityName: Apple Multiple Products Out-of-Bounds Write Vulnerability
dateAdded: 2026-09-29
shortDescription: Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
requiredAction: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
dueDate: 2026-10-13
knownRansomwareCampaignUse: Unknown
forensicTriage: No
notes: https://support.apple.com/en-us/149226 ; https://support.apple.com/en-us/149228 ; https://support.apple.com/en-us/149229 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-86950
cwes: CWE-787

The fifth block is how to check a build and what to expect. The steps are Apple's own, from its update page (page); the expected builds are this site's reading of Apple's advisories and are marked derived. To find a model, Apple's identify your iPhone model page lists them by model number.

Open Settings.
Tap General.
Tap Software Update. The currently installed version of iOS is shown, and whether an update is available.

Expected build for CVE-2026-86950 (derived):
iPhone XS, XS Max, XR, iPad 7th generation: iOS or iPadOS 18.7.11
iPhone 11 and later: iOS or iPadOS 26.7.1 or later on the 26 line (26.7.2 is current), or any 27 build
macOS Sequoia 15.8.1 or later (15.8.2 is current); macOS Tahoe 26.7.1 or later (26.7.2 is current)
iOS 16, iOS 15, iPadOS 17, macOS Sonoma, macOS Ventura: no fix listed

What to do, in the order worth doing it

The order below follows the record: find who is on which path first, because the path differs by model, then close the gaps in order of exposure.

Method, interest and what could not be verified

Apple writes the advisories, so they are also the record of what Apple chose to say; its own pages state that it does not disclose, discuss or confirm security issues until patches or releases are available. SecurityWeek and BleepingComputer are secondary sources, read here as pointers. Every figure above is from Apple's pages, the CVE record or the KEV file, read by this site, or is derived and labelled.

The question that exposes the gap

On 28 September Apple said it knew of a report that this flaw may have been exploited, and shipped a fix for iPhone 11 and later. For the next 28 days, which of your iPhones could not take that fix, and what did anyone decide to do about them?

Key facts