Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-113960

iMessage group history readable by newly added members

CVSS
—
EPSS
—
Published
·
Modified
Analyze CVE-2026-113960 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

On Apple devices, a person added to an iMessage group may be able to read messages sent before they joined. Triggering it requires being added to that group; no further interaction is described. Apple fixed the issue by removing the vulnerable code in the listed iOS, iPadOS, macOS, visionOS, and watchOS releases. Affected version ranges are not stated.

What to do: Update to iOS/iPadOS 26.7.3 or 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, or watchOS 27.2.1.

ProductAffectedFixed in
Apple iOS—26.7.3 and 27.2.1
Apple iPadOS—26.7.3 and 27.2.1
Apple macOS Golden Gate—27.2.1
Apple macOS Sequoia—15.8.3
Apple macOS Tahoe—26.7.3
Apple visionOS—27.2.1
Apple watchOS—27.2.1
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent before they joined.

NVD CVE.org GitHub PoCs EPSS (—)

In the news

5 stories