Apple released security updates that address two iMessage vulnerabilities that could let attackers join private group conversations and read messages, or allow newly added members to access earlier exchanges.
The fixes arrived in iOS 27.2.1 and iPadOS 27.2.1, alongside patches for Bluetooth and AirPlay weaknesses that could enable unauthorized device pairing.
Apple’s security advisory credits an anonymous researcher with reporting both Messages issues.
iMessage is Apple’s messaging service built into the Messages app on iPhones, iPads, and Macs. The two vulnerabilities concern access to group conversations, making them particularly relevant to users sharing personal or sensitive information in those chats.
Two ways to expose group messages
The first vulnerability, tracked as CVE-2026-113961, could let a remote attacker join an iMessage group and read messages exchanged there. Apple attributes the problem to an authorization weakness and says it strengthened validation to resolve it.
The second flaw, CVE-2026-113960, affects access to a group’s conversation history. Someone added to an iMessage group could potentially retrieve messages exchanged before their arrival. Apple addressed this issue by removing the affected code.
Apple also lists both vulnerabilities in its iOS 26.7.3 and iPadOS 26.7.3 advisory, so users remaining on that software branch have an update available. The same two issues are patched in macOS Golden Gate 27.2.1.
Bluetooth and AirPlay fixes
The mobile updates also address two CoreUtils vulnerabilities affecting device pairing. CVE-2026-113965 could let a malicious Bluetooth device establish a pairing without the user’s involvement. CVE-2026-113964 could allow a nearby attacker to evade pairing-code attempt limits and pair without user interaction.
Two additional issues, CVE-2026-113968 in AirPlay and CVE-2026-113969 in rapportd, concern bypasses of pairing-code rate limits. The former requires Bluetooth proximity, while the latter exposes AirPlay pairing attempts to an attacker on the same network. These limits normally restrict repeated attempts to guess a pairing code.
iOS 27.2.1 also fixes a Bluetooth use-after-free vulnerability, CVE-2026-113970, and an out-of-bounds write in the Brotli compression component, CVE-2026-111497, both involving memory corruption. A separate App Intents authorization flaw, CVE-2026-113963, could expose sensitive user data to an app.
iPhone and iPad users should open Settings > General > Software Update and install the latest update offered for their device. Apple recommends backing up first and connecting the device to power and Wi-Fi. Automatic installation can also be enabled from the same menu under Automatic Updates.
Leave a Reply