The facts

  1. Processing a maliciously crafted file may allow arbitrary code execution. Apple says it fixed an out-of-bounds write through improved bounds checking. [1]

  2. Apple’s release index lists these updates for iPhone XS, iPhone XS Max, iPhone XR and seventh-generation iPad. [3]

  3. SecurityWeek reports that the same flaw was first patched in late September in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. The October release brings the fix to the older iOS 18 branch. [2]

Still unconfirmed

  • The checked advisory does not identify the attacker, targets or full scope of the reported campaign.

Sources

References support the numbered facts above. Source checks: 29 Oct 2026, 02:05 UTC.

  1. Security content of iOS 18.7.11 and iPadOS 18.7.11

    Apple · Primary source · 26 Oct 2026

  2. Apple updates and exploited-flaw backport

    SecurityWeek · Reporting · 27 Oct 2026

  3. Security-release index and supported devices

    Apple · Primary source

    Same issuer as source 1. The release index supplies the device list; the individual advisory has a malformed device-list string.

Report a factual error