Apple Patches Exploited CoreGraphics Flaw on Older iPhones

Critical Security Patch for Legacy Devices

Apple has released a series of software updates addressing a significant security vulnerability in its CoreGraphics framework. The company confirmed that this flaw has been actively exploited in the wild. Specifically, Apple stated it is aware of reports indicating that the issue was used in extremely sophisticated attacks targeting specific individuals. These attacks occurred on versions of iOS prior to iOS 27. The release serves as a critical patch for devices that are no longer eligible for the latest major operating system updates.

Affected Hardware and Software Versions

The CoreGraphics fix is particularly important for older hardware that cannot run the newest iOS 26. The update, designated as iOS 18.7.11 and iPadOS 18.7.11, is mandatory for iPhone XS, iPhone XS Max, iPhone XR, and the seventh-generation iPad. These devices remain on older software branches. Apple warned that processing a maliciously crafted file on these devices could lead to arbitrary code execution. This type of vulnerability allows attackers to run any code on the victim's device, potentially granting full control over the system. The targeted nature of the attacks suggests a high level of sophistication, likely involving state-sponsored or high-value individual threats.

Broader Security Improvements

Beyond the specific CoreGraphics fix, Apple pushed updates for devices running newer operating systems. iOS 26.7.2 and iPadOS 26.7.2 include security fixes for 134 vulnerabilities. Unlike the CoreGraphics flaw, none of these 134 issues are currently flagged as having been exploited in the wild. This distinction highlights the urgency of the older device patch. The updates also cover macOS Tahoe 26.7.2 and macOS Sequoia 15.8.2, ensuring consistency across Apple's desktop and mobile platforms. These updates address various underlying security issues within the operating systems, though specific details on the 134 vulnerabilities were not itemized in the release notes.

tvOS Update and New Hardware Support

The tvOS 26.6.1 update stands out as the only release among these patches that includes user-facing changes. While it contains security improvements, its primary new feature is support for the fourth-generation Siri Remote. This compatibility extends to the Apple TV HD and the first-generation Apple TV 4K. This addition allows users with these older streaming devices to utilize the latest remote hardware. The inclusion of this feature alongside security updates ensures that older Apple TV models remain functional and secure for current use cases.

Installation and Availability

All these updates are available immediately for installation. Users can access the patches through the Software Update section in the Settings app on iPhone and iPad. On Mac devices, the updates are found in System Settings under General. Apple encourages all users, particularly those with older hardware, to install these updates as soon as possible. The rapid deployment of the CoreGraphics fix underscores the severity of the exploited vulnerability. By addressing the issue for devices that cannot run iOS 27, Apple aims to close a significant security gap for a large base of legacy users.

Significance of the Patch

The confirmation of active exploitation makes this update critical. While many security patches address theoretical risks, this one responds to confirmed attacks. The targeted nature of the attacks means that while the general public may not be at immediate risk, specific individuals could be under threat. The patch ensures that older devices, which often lack the latest security features of newer OS versions, are protected against this specific threat vector. This move also reinforces Apple's commitment to supporting older devices with security updates, even when they cannot receive feature updates.

Key takeaways

• Apple patched a CoreGraphics vulnerability actively exploited in targeted attacks on iOS versions before iOS 27.
• The fix applies to iPhone XS, XS Max, XR, and seventh-gen iPad, which cannot run iOS 26.
• iOS 26.7.2 and iPadOS 26.7.2 update 134 additional vulnerabilities, none currently exploited.
• macOS Tahoe 26.7.2 and Sequoia 15.8.2 received security fixes.
• tvOS 26.6.1 adds support for the fourth-generation Siri Remote on older Apple TV models.
• All updates are available now via Software Update settings on respective devices.