Apple has released a series of security updates to address multiple vulnerabilities affecting iMessage, Bluetooth, and the Brotli compression library. The fixes target privacy issues in group chats and pairing weaknesses that could be exploited by attackers in close proximity.
One iMessage flaw, tracked as CVE-2026-113961, is an authorization issue that could let a remote attacker join a group chat and receive its messages. Apple fixed it through improved validation. A separate flaw, CVE-2026-113960, could allow someone added to a group to access messages sent before they joined. The updates also resolve CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder that could let malicious input corrupt memory. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Brotli issue to its Known Exploited Vulnerabilities catalog on October 27.
The security advisory for iOS and iPadOS 27.2.1 describes all three flaws. Affected devices include the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple Watch models. The notes do not indicate whether the flaws have been exploited in the wild or what an attacker would need to succeed. It is also unclear whether group members would see an unauthorized participant or whether every member must update for protection.
All nine updates fix Bluetooth and AirPlay flaws. Two vulnerabilities could allow a malicious Bluetooth device to pair without user interaction. Two others could let an attacker bypass the limit on pairing code attempts, one from Bluetooth range and one from the same network. Another flaw could enable an attacker in Bluetooth range to corrupt process memory.
