Skip to content
NewA calmer, faster ZeroHour
Vulnerability1 · 1 read

CVE-2026-113964

Bluetooth pairing rate-limit bypass on Apple devices

CVSS 3.1
5.4 medium
EPSS
—
Published
·
Modified
Analyze CVE-2026-113964 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

A logic flaw in Apple Bluetooth pairing state management lets an attacker in Bluetooth range bypass the rate limit on pairing-code attempts and pair without credentials or user interaction. Impact is limited confidentiality and integrity loss. Fixes are in the listed iOS, iPadOS, macOS, visionOS, and watchOS releases; Apple did not state affected ranges.

What to do: Install Apple's fixed releases: iOS/iPadOS 18.7.12, 26.7.3, or 27.2.1; macOS Golden Gate 27.2.1, Sequoia 15.8.3, or Tahoe 26.7.3; visionOS 27.2.1; watchOS 26.6.1 or 27.2.1.

ProductAffectedFixed in
Apple iOS—18.7.12, 26.7.3, 27.2.1
Apple iPadOS—18.7.12, 26.7.3, 27.2.1
Apple macOS Golden Gate—27.2.1
Apple macOS Sequoia—15.8.3
Apple macOS Tahoe—26.7.3
Apple visionOS—27.2.1
Apple watchOS—26.6.1, 27.2.1
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction.

Weakness
CWE-307
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD CVE.org GitHub PoCs EPSS (—)

In the news

4 stories