Apple patches Bluetooth and AirPlay pairing flaws across platforms
Ten fixes cover current and older Apple releases; advisories do not report exploitation of the Apple issues.
68
CVE-2026-113963
Incorrect authorization lets apps read data on Apple devices
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An authorization flaw from poor state management in iOS, iPadOS, visionOS, and watchOS can let an app access sensitive user data. A local app with low privileges can trigger it without user interaction. Impact is limited to confidentiality. Devices not yet on the 27.2.1 releases are affected.
What to do: Update to iOS 27.2.1, iPadOS 27.2.1, visionOS 27.2.1, or watchOS 27.2.1. Apple has not named a workaround.
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | — | 27.2.1 |
| Apple iPadOS | — | 27.2.1 |
| Apple visionOS | — | 27.2.1 |
| Apple watchOS | — | 27.2.1 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data.
- Weakness
- CWE-863
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
In the news
5 storiesBinance warns iOS flaw can leak wallet secrets to other apps
A public WQ Files proof of concept reads other apps' data on iOS 26.7.1, 27.0.1, and 27.2; no crypto losses are confirmed.
66
Apple patches nine flaws across iOS, macOS, watchOS and visionOS
Updates cover iMessage group access, Bluetooth and AirPlay pairing-code bypasses, and one lock-screen AirPlay issue limited to iOS/iPadOS 26.
64
Apple patches nine iOS 27.2.1 and iPadOS 27.2.1 flaws, none exploited
Fixes include Bluetooth pairing-limit bypasses, AirPlay flaws, and iMessage group access; Apple reports no real-world use.
64
Apple iOS 27.2.1 fixes nine flaws in iMessage, Bluetooth, and AirPlay
The same release covers iPadOS 27.2.1; Apple does not say any of the nine flaws are exploited.
62