was 60 miles (97km) from the Saudi port of Jeddah.
The ship's two main storage tanks are said to have been damaged, causing an oil spill in the Red Sea, but no-one was reportedly injured.
Iran's foreign ministry claimed the vessel had been "targeted twice" but did not provide further details.
On Friday morning, an unnamed source told Iran media the vessel was struck by missiles "probably" originating from Saudi Arabia.
But the NIOC later denied the claim. It said two separate explosions took place aboard the ship that were "probably" caused by missiles.
The explosion is yet to be independently verified, and details of the tanker itself are unclear. Iranian state TV earlier identified it as the Sinopa, but the NIOC later said it was another vessel named Sabiti.
Pictures allegedly taken on Friday aboard the Sabiti have been published by Iranian state TV, showing no visible signs of damage.
Publicly-available ship tracking records show both ships are currently in the Red Sea. The Sinopa turned its transmitter on earlier this week for the first time in more than 50 days. The Sabiti, meanwhile, turned its tracker on early Friday after nearly 60 days of no transmissions.
Under international regulations, all vessels above a certain tonnage must be fitted with the trackers, known as automatic identification systems (AIS). But ships are not required to have their AIS turned on all the time.
A source at maritime analytics firm Windward told the BBC it was common for Iranian tankers to turn off AIS to avoid detection - often to evade international sanctions or harassment from Saudi Arabia.
Because of safety regulations, vessels must have their AIS switched on when they are close to the Suez Canal. The Windward source said Sabiti was behaving unusually because, when going through the canal, it only switches on its AIS when rules require - but in this instance, the AIS had been turned on hundreds of miles from the Suez after being "dark" for two months.
Michelle Bockmann, an analyst at shipping newspaper Lloyds List, told the BBC that the tanker - whichever one it was - was "probably" carrying oil to Syria.
"That really is, along with China, the only market there is for Iranian crude now since the US tightened sanctions in May," said Ms Bockmann. "We're seeing geopolitics playing out within the global shipping and tanker markets, and this is just an extension of the instability that we're seeing in the region."
The latest incident came amid heightened tension between Iran and Saudi Arabia in recent months.
Last month, 18 drones and seven cruise missiles hit a major oil field and processing facility in Saudi Arabia, which blamed Iran for the attack.
And US officials said Iran was responsible for attacks on two oil tankers in the Gulf in June and July, as well as attacks on another four tankers in May.
Iran denied involvement in all the incidents.