Apple patches nine iOS 27.2.1 and iPadOS 27.2.1 flaws, none exploited
Original title: Apple Fixes 9 Security Vulnerabilities in iOS 27.2.1, Including Bluetooth Pairing and iMessage Flaws
Fixes include Bluetooth pairing-limit bypasses, AirPlay flaws, and iMessage group access; Apple reports no real-world use.
Apple released iOS 27.2.1 and iPadOS 27.2.1 on November 9, 2026, fixing nine flaws in Bluetooth, AirPlay, Messages, App Intents, brotli, and related components. The update covers iPhone 11 and later and listed recent iPad models. Several bugs let a nearby or same-network attacker bypass pairing-code limits or pair without user action. Apple does not say any flaw was used in attacks.
Unconfirmed: Apple does not say the flaws were used in attacks, and several reporters are unnamed.
- CVE-2026-113964 and CVE-2026-113965 can pair Bluetooth devices without user action.
- CVE-2026-113961 could let a remote person join an iMessage group and read messages.
- CVE-2026-113970 is a Bluetooth use-after-free that can corrupt process memory.
- The update covers iPhone 11 and later plus listed recent iPad models.
Impact: Unauthorized pairing, memory corruption, or iMessage access
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | — | 27.2.1 |
| Apple iPadOS | — | 27.2.1 |
- 1.Install iOS 27.2.1 or iPadOS 27.2.1 from Settings, General, Software Update.
- 2.Turn off Bluetooth and AirPlay when unused to reduce exposure.
- CVEs
- CVE-2026-113964CVE-2026-113965CVE-2026-113968CVE-2026-113969CVE-2026-113970CVE-2026-113963CVE-2026-111497CVE-2026-113961CVE-2026-113960
- Vendors
- Apple
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-113970 | Use-after-free in Apple OSes over Bluetooth range | 8.8 group max | — |
From the original article
3 min read at cybersecuritynews.com
Apple released iOS 27. 2. 1 and iPadOS 27.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.