Apple Fixes 9 Security Vulnerabilities in iOS 27.2.1, Including Bluetooth Pairing and iMessage Flaws

Apple released iOS 27.2.1 and iPadOS 27.2.1 on November 9, 2026. The update fixes nine security flaws in Bluetooth, AirPlay, Messages, and other parts of the system.

It runs on iPhone 11 and later, and on several recent iPad models, including iPad Pro, iPad Air, iPad 9th generation, and iPad mini 6th generation. Apple’s security release page lists the update. Apple does not say any of these flaws were used in real attacks.

Most fixes address how devices pair with each other. Two bugs let someone get around the limit on pairing code guesses. Normally, a device blocks a person who keeps guessing wrong codes. If that limit fails, someone nearby could keep trying until a guess works.

The first, CVE-2026-113964, sits in CoreUtils. Apple says someone in Bluetooth range could skip the limit and pair with a device without the owner doing anything.

An anonymous researcher reported it. A second CoreUtils bug, CVE-2026-113965, could let a malicious Bluetooth device pair on its own, with no user action. Apple found that one itself.

Two more bugs affect AirPlay pairing codes. CVE-2026-113968 lets someone within Bluetooth range bypass the AirPlay limit. CVE-2026-113969 sits in rapportd and lets a person on the same network do the same. Both were fixed by improving how the system tracks its state.

Apple Fixes 9 Security Vulnerabilities

Bluetooth also had a memory bug. CVE-2026-113970 is a use-after-free flaw, which means the system keeps using memory after it has been released. Someone within Bluetooth range could use it to corrupt process memory. Apple fixed it with better memory handling.

The Messages app got two fixes, both reported by anonymous researchers. CVE-2026-113961 could let a remote person join an iMessage group chat and read its messages.

Apple fixed it by adding stronger checks on who can join. CVE-2026-113960 let a person added to a group read messages sent before they joined. Apple removed the code behind that flaw.

iMessage group chats can expose private conversations when access controls fail, although earlier flaws were more severe, including the NICKNAME zero-click exploit used against high-profile targets and fixed in iOS 18.3.

CVE-2026-113963 in App Intents could let an app access sensitive user data. László Várady reported it, and Apple fixed it by adding stronger authorization checks.

CVE-2026-111497 sits in brotli, a data compression tool. A specially crafted file could trigger an out-of-bounds write, meaning data lands outside its intended memory space. That can lead to memory corruption. Apple fixed it with better input checks and did not name a reporter.

Open Settings, tap General, then Software Update, and install iOS 27.2.1 or iPadOS 27.2.1. Apple notes that you can’t roll back an update once it is installed. Turning off Bluetooth and AirPlay when you do not need them also reduces your exposure.

Pairing flaws remind us that attackers don’t always need malware to get in. Sometimes they only need enough guesses. The AirPlay fixes also follow a rough year for the protocol.

Cyber Security News reported on the AirBorne AirPlay flaws, which put billions of devices at risk. Apple tracks each issue by its CVE ID, a shared number system explained on the CVE Program site. Anyone who finds an Apple bug can report it through Apple Product Security.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Apple Fixes 9 Security Vulnerabilities in iOS 27.2.1, Including Bluetooth Pairing and iMessage Flaws appeared first on Cyber Security News.