Apple patches Bluetooth and AirPlay pairing flaws across platforms
Original title: Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms
Ten fixes cover current and older Apple releases; advisories do not report exploitation of the Apple issues.
Apple released updates for iOS, iPadOS, macOS, watchOS and visionOS fixing 10 vulnerabilities, five of them tied to Bluetooth and AirPlay pairing. Several let an attacker in Bluetooth range bypass pairing-code limits or pair without user interaction, and one is a Bluetooth use-after-free that can corrupt process memory. Two Messages bugs can expose group chats. The releases also include the Brotli flaw called Node2Shell, which has been targeted elsewhere, with no indication of attacks on Apple products.
Unconfirmed: Node2Shell has been targeted in the wild, but the article gives no indication of attacks against Apple products.
- Shared fixes appear in iOS and iPadOS 27.2.1, 26.7.3 and 18.7.12, among other releases.
- macOS fixes cover Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3.
- CVE-2026-113971 is limited to the iOS and iPadOS 18.7.12 advisory.
- CVE-2026-113963 is listed only for newer iOS, iPadOS, watchOS and visionOS releases.
- Apple credits itself for five flaws; an anonymous researcher and László Várady reported others.
Impact: Unauthorized pairing, memory corruption, or exposure of Messages chats
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS and iPadOS | versions addressed by 27.2.1, 26.7.3 and 18.7.12 | 27.2.1, 26.7.3 and 18.7.12 |
| Apple macOS | Golden Gate, Tahoe and Sequoia versions addressed by the updates | Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3 |
| Apple watchOS | versions addressed by 27.2.1 and 26.6.1 | 27.2.1 and 26.6.1 |
| Apple visionOS | version addressed by 27.2.1 | 27.2.1 |
- 1.Install the listed iOS, iPadOS, macOS, watchOS and visionOS security updates.
- CVEs
- CVE-2026-113968CVE-2026-113969CVE-2026-113964CVE-2026-113965CVE-2026-113970CVE-2026-113961CVE-2026-113960CVE-2026-111497CVE-2026-113963CVE-2026-113971
- Vendors
- Apple
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-113970 | Use-after-free in Apple OSes over Bluetooth range | 8.8 group max | — |
From the original article
2 min read at securityweek.com
Apple has patched Bluetooth and AirPlay pairing flaws, iMessage vulnerabilities, and an exploited Brotli bug across its platforms. The post Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.