Apple Warns of Sophisticated Attack Exploiting iPhone Vulnerability

Apple has alerted some iPhone users to a security vulnerability that may have been exploited in what the company described as an "extremely sophisticated attack." The flaw, identified as CVE-2026-86950, resides in CoreGraphics, the software responsible for processing and displaying visual content on Apple devices.

According to Apple's advisory, the vulnerability could allow attackers to execute malicious code on a device by tricking it into processing a specially crafted file. This file, though appearing ordinary, is deliberately altered to exploit a weakness in the software, potentially enabling an attacker's code to run by writing information outside an intended area of memory.

Apple stated that this issue "may have been exploited in an extremely sophisticated attack against specific targeted individuals" on versions of iOS prior to iOS 27. The company credited Meta Product Security for reporting the vulnerability and indicated that the problem has been fixed by enhancing checks on memory boundaries within the CoreGraphics software.

Security researchers at calif.io also demonstrated that a PDF containing a specially crafted font could trigger memory corruption, raising a possible connection to WhatsApp. However, the researchers did not establish how the actual attacks were delivered, and Apple's advisory does not confirm that this flaw alone granted hackers complete control of a device.

In addition to the CoreGraphics vulnerability, Apple's latest update, iOS 18.7.11, addresses two other security flaws. One could permit a malicious application to access the device's camera without user permission, and another could enable an app to expose sensitive personal information. Apple has not indicated that these latter two flaws were used in the sophisticated attack targeting specific individuals.

The update is available for iPhone XS, iPhone XS Max, and iPhone XR models. Apple also released a similar update, iPadOS 18.7.11, for the seventh-generation iPad.

Apple recommends that affected users install the update promptly to protect their devices. To update, users should navigate to Settings, then General, and tap Software Update. The company advises backing up the iPhone using iCloud or a computer before initiating the update, ensuring the device is plugged into power and connected to Wi-Fi.

For users concerned about storage space, Apple's system may offer to temporarily remove apps to make room for the update, with apps automatically being reinstalled afterward. Users who are unable to update wirelessly can follow Apple's instructions for updating through a computer.

To help prevent future security risks, Apple encourages users to enable Automatic Updates in the Software Update settings, allowing the device to install updates overnight while charging and connected to Wi-Fi.