Apple iOS 27.2.1 fixes nine flaws in iMessage, Bluetooth, and AirPlay

Original title: Apple iOS 27.2.1 Fixes 9 Security Vulnerabilities Affecting iMessage, Bluetooth, and AirPlay

GBHackersby DivyaNov 10, 2026 · 09:05 UTC (1d ago)2 min read1

AI summary · x-ai/grok-4.7Summaries by Vani AI

The same release covers iPadOS 27.2.1; Apple does not say any of the nine flaws are exploited.

Apple released iOS 27.2.1 and iPadOS 27.2.1 on November 9, 2026, fixing nine flaws in iMessage, Bluetooth pairing, AirPlay, App Intents, and brotli. Several let a nearby attacker skip pairing-code limits or pair without interaction, and two Messages bugs can expose group chats. Fixes use memory management, validation, and state checks. Apple does not say the flaws are exploited.

Unconfirmed: Apple does not say whether any of the nine flaws are exploited.

Key facts

CVE-2026-113970 is a Bluetooth use-after-free that can corrupt memory in range.
CVE-2026-113961 let a remote attacker join an iMessage group and read messages.
CVE-2026-113960 exposed messages sent before a user joined a group.
The update supports iPhone 11 and newer plus listed recent iPad models.
CVE-2026-111497 is an out-of-bounds write in the brotli library.

Security assessment · AI, from the article

Impact: memory corruption, silent pairing, or private chat exposure

Product	Affected	Fixed in
Apple iOS	—	27.2.1
Apple iPadOS	—	27.2.1

What to do

1.Install iOS 27.2.1 or iPadOS 27.2.1.

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2026-113968 CVE-2026-113963 CVE-2026-113970 CVE-2026-111497 CVE-2026-113965 CVE-2026-113964 CVE-2026-113961 CVE-2026-113960 CVE-2026-113969

Tags: ios ipados imessage bluetooth airplay brotli

Vendors: Apple
Products: iOS iPadOS iMessage AirPlay

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-111497	Buffer overflow in Google Brotli decoder 1.0.3–1.2.0	9.2	83%	KEVPoC ×25	20d ago KEV Oct 27, 2026
CVE-2026-113970 +7 related CVEs CVE-2026-113961 CVE-2026-113963 CVE-2026-113964 CVE-2026-113965 CVE-2026-113968 CVE-2026-113960 CVE-2026-113969	Use-after-free in Apple OSes over Bluetooth range	8.8 group max	—		1d ago

From the original article

2 min read at gbhackers.com

Apple released iOS 27. 2. 1 and iPadOS 27.

GBHackers

By Divya · gbhackers.com

Read the full article at GBHackers

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.