Apple patches Bluetooth and AirPlay pairing flaws across platforms
Ten fixes cover current and older Apple releases; advisories do not report exploitation of the Apple issues.
68
CVE-2026-113971
Lock-screen AirPlay pairing in iOS and iPadOS
- CVSS 3.1
- 3.5 low
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
On a locked iPhone or iPad, options that should stay unavailable can still let someone pair the device with an AirPlay receiver. An attacker needs physical access to the device and no account or user interaction. Pairing from the lock screen can disclose or alter limited device state. Devices not yet on the fixed iOS or iPadOS releases are affected.
What to do: Update to iOS 18.7.12 or 26.5, or iPadOS 18.7.12 or 26.5, which restrict options offered on a locked device.
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | — | 18.7.12, 26.5 |
| Apple iPadOS | — | 18.7.12, 26.5 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen.
- Weakness
- CWE-284
- Vector
- CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
In the news
2 storiesApple patches nine flaws across iOS, macOS, watchOS and visionOS
Updates cover iMessage group access, Bluetooth and AirPlay pairing-code bypasses, and one lock-screen AirPlay issue limited to iOS/iPadOS 26.
64