Apple has rolled out iOS 18.7.11 and iPadOS 18.7.11 to fix security issues, including a CoreGraphics flaw related to targeted exploitation. Released on October 26, 2026, these updates safeguard older devices from malicious file processing that could lead to arbitrary code execution. Apple Responds to Exploited iOS Zero-Day Apple acknowledged Meta Product Security for reporting the vulnerability and addressed the underlying memory-safety issue by enhancing bounds checking.
Apple stated it was aware of a report that the vulnerability “may have been exploited in an extremely sophisticated attack against specific targeted individuals” using versions of iOS prior to iOS 27. Malicious file processing can offer an execution opportunity, but Apple’s description doesn’t specify how attackers delivered the file or whether exploitation required user interaction.
However, the disclosure does not describe the affected parsing routine, conditions for memory corruption, execution privileges, or other vulnerabilities potentially involved in the reported attacks. Improved checks have resolved the vulnerability, which the company credits to Mustafa Calap, identified as @ordinal0 of dbg.re, and Nik Tsytsarkin of Meta Red Team X. Apple's central release catalog offers a more accurate compatibility guide for this specific release: the three iPhone models and the seventh-generation iPad.
Organizations should verify device eligibility against that catalog rather than assuming every model listed in the pasted excerpt receives this particular update.
