Apple released iOS 18.7.11 on October 26, 2026, targeting older devices such as the iPhone XS, iPhone XS Max, iPhone XR, and the seventh-generation iPad. This update addresses three vulnerabilities, including CVE-2026-86950, CVE-2026-65339, and CVE-2026-86990.
CVE-2026-86950 is an out-of-bounds write vulnerability in CoreGraphics that may allow arbitrary code execution. Apple has confirmed that this vulnerability may have been exploited in targeted attacks against specific individuals, though the identities of those targeted have not been disclosed.
The update also fixes CVE-2026-65339, an audio vulnerability that could lead to the disclosure of sensitive user information. Additionally, CVE-2026-86990 is addressed, which is a CoreMedia vulnerability allowing malicious applications to access the camera without user permission.
The iOS 18.7.11 update is a backport, bringing fixes from newer software versions to older devices that cannot upgrade to iOS 27. The previous update for these devices was iOS 18.7.10, released on August 17, 2026.