CVE-2026-113960

Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities

Apple has released multiple security updates addressing critical flaws in iMessage that could allow unauthorized access to group chat messages. One vulnerability, tracked as CVE-2026-113961, is an authorization issue that permitted remote attackers to join group chats and receive ongoing messages through improved validation fixes. A second issue, CVE-2026-113960, enabled newly added participants to access messages sent before they joined the conversation. The updates also resolve an out-of-bounds write flaw in Google's Brotli compression library, CVE-2026-111497, which CISA added to its Known Exploited Vulnerabilities catalog on October 27. Additionally, nine separate updates address multiple Bluetooth and AirPlay vulnerabilities that could enable unauthorized pairing or memory corruption without user interaction. The company has not confirmed active exploitation of the iMessage or Bluetooth issues and provided no workarounds for users unable to update immediately.