--- id: "CVE-2026-65339" kind: "vulnerability" aliases: ["CVE-2026-65339"] title: "A logic issue was addressed with improved checks" severity: "high" cvss: 5.0 epss: null exploited: false status: "open" category: "vendor" products: [{"name": "apple ipados", "fixed": ["26.6.1"], "affected": "< 26.6.1", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["26.6.1"], "affected": "< 26.6.1", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["26.6.2"], "affected": ">= 26.0, < 26.6.2", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "ios", "ipados", "vendor", "vendor-advisory"] not_affected_if: ["already-updated"] published_at: "2026-08-17T22:17:24+00:00" first_seen_at: "2026-10-29T04:33:04+00:00" updated_at: "2026-10-29T04:41:59+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/149225", "first_seen_at": "2026-10-29T04:33:04+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65339", "first_seen_at": "2026-10-29T04:41:59+00:00"}] --- # A logic issue was addressed with improved checks Apple's iOS 18.7.11 and iPadOS 18.7.11 update fixes an out-of-bounds write in CoreGraphics that a maliciously crafted file can trigger to run code. Apple says it may have been exploited in a very targeted attack on earlier iOS versions. The same release also fixes a leak of sensitive data to apps and a camera access issue for malicious apps. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:apple ipados affected < 26.6.1 fixed 26.6.1 - vendor:apple iphone os affected < 26.6.1 fixed 26.6.1 - vendor:apple macos affected >= 26.0, < 26.6.2 fixed 26.6.2 ## How to check - Check the iOS or iPadOS version under Settings > General > About; the advisory covers iOS 18.7.11 and iPadOS 18.7.11 and later. ## Fix - iOS 18.7.11 and iPadOS 18.7.11 per Apple's advisory (the sources do not list a separate version range). ## Timeline - 2026-10-29T04:33:04+00:00 lab https://support.apple.com/en-us/149225 — Apple: About the security content of iOS 18.7.11 and iPadOS 18.7.11 - Apple Support - 2026-10-29T04:41:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65339 ## Documents - [advisory] Apple: About the security content of iOS 18.7.11 and iPadOS 18.7.11 - Apple Support https://support.apple.com/en-us/149225 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/148281 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/148282 ## From the sources About the security content of iOS 18.7.11 and iPadOS 18.7.11 - Apple Support # About the security content of iOS 18.7.11 and iPadOS 18.7.11 This document describes the security content of iOS 18.7.11 and iPadOS 18.7.11. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## iOS 18.7.11 and iPadOS 18.7.11 Released October 26, 2026 ### Audio Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generationAir 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An app may be able to leak sensitive user information Description: A logic issue was addressed with improved checks. CVE-2026-65339: Mustafa Calap (@ordinal0, dbg.re), Meta Red Team X - Nik Tsytsarkin ### CoreGraphics Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generationAir 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. Description: An out-of-bounds write issue was addressed with improved bounds checking. ### CoreMedia Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generationAir 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: A malicious app may be able to access the camera without user permission Description: An access issue was addressed with improved access restrictions. Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information. Published Date: October 26, 2026 --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_