Apple fixes iMessage and wireless flaws in iOS update

Apple has released iOS 27.2.1 to address a set of privacy and wireless‑protocol vulnerabilities in iPhone devices. The update, described by Apple as a critical maintenance release, patches issues within core wireless frameworks that could expose iMessage communications, including private group chats, and strengthens pairing and authentication routines to prevent unauthorised connections by nearby devices. The advisory notes that unpatched firmware can be weaponised quickly, and urges immediate installation of the update.

The disclosures focus on two iMessage flaws and several Bluetooth/AirPlay risks. The primary iMessage fault is CVE-2026‑113961, an authorization defect in the message processing pipeline that could let remote attackers infiltrate private group chats. A secondary issue, CVE-2026‑113960, allowed newly added participants to view historical group messages due to a structural flaw; Apple removed the defective code to enforce confidentiality.

In wireless components, CVE-2026‑113965 permits peripherals to pair without user interaction, while CVEs CVE-2026‑113964, CVE-2026‑113968 and CVE-2026‑113969 describe bypasses of passcode limits via memory corruption in the Bluetooth daemon, enabling potential local privilege elevation. The official Apple advisory confirms remediation of these memory‑corruption issues and related defects, and notes that legacy devices can install patched versions such as iOS 26.7.3 or iOS 18.7.12.

The firm also warns that targeted exploit frameworks like DarkSword may pursue older platforms, underscoring the importance of applying the update across supported devices.