Live › vulnerability › CVE-2026-65339
Apple's iOS 18.7.11 and iPadOS 18.7.11 update fixes an out-of-bounds write in CoreGraphics that a maliciously crafted file can trigger to run code. Apple says it may have been exploited in a very targeted attack on earlier iOS versions. The same release also fixes a leak of sensitive data to apps and a camera access issue for malicious apps.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 04:33 UTC, 0h before NVD. All times on this page are UTC.
Apple devices in the listed range, including iPhone XS, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. The CoreGraphics flaw needs a crafted file to be opened or processed, so the risk is highest on devices that handle untrusted files. Devices already on the fixed release are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apple ipados | vendor | < 26.6.1 | 26.6.1 |
| apple iphone os | vendor | < 26.6.1 | 26.6.1 |
| apple macos | vendor | >= 26.0, < 26.6.2 | 26.6.2 |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
About the security content of iOS 18.7.11 and iPadOS 18.7.11 - Apple Support
This document describes the security content of iOS 18.7.11 and iPadOS 18.7.11.
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
Released October 26, 2026
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generationAir 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later
Impact: An app may be able to leak sensitive user information
Description: A logic issue was addressed with improved checks.
CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generationAir 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later
Impact: Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
Description: An out-of-bounds write issue was addressed with improved bounds checking.
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generationAir 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later
Impact: A malicious app may be able to access the camera without user permission
Description: An access issue was addressed with improved access restrictions.
Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.
Published Date: October 26, 2026
This page as .md · .json · in your agent: get_signal("CVE-2026-65339")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.