Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekEduard Kovacs

Apple patches Bluetooth and AirPlay pairing flaws across platforms

Part of the CVE-2026-113964 story · since 10 Nov

Quiet for 2 dayslast report 11 Nov2 articles2 outlets
10 Nov · SANS ISC first12 NovNowThis article2nd of 2
  • Tue 10 Nov, 14:01 UTC. SANS ISC, first report. Apple fixes nine flaws in November updates for its devices.
  • Wed 11 Nov, 08:01 UTC. SecurityWeek, its first report on the story. Apple patches Bluetooth and AirPlay pairing flaws across platforms. This article, 2nd of 2.

Apple has issued security updates across iOS, iPadOS, macOS, watchOS and visionOS to fix ten vulnerabilities tied to Bluetooth and AirPlay pairing, iMessage, and a Brotli issue, with several flaws exploitable from nearby proximity or local network conditions. Five of the flaws are addressed in all nine releases: iOS/iPadOS 27.2.1, 26.7.3 and 18.7.12; macOS Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3; watchOS 27.2.1 and 26.6.1; and visionOS 27.2.1.

Apple credits the fixes to multiple researchers, including an anonymous reporter for three Messages flaws and CVE-2026-113964, with László Várady named for the App Intents issue.

The most consequential category involves pairing limits. CVE-2026-113964 (CoreUtils) and CVE-2026-113965 describe bypasses that could allow a Bluetooth device to pair with a target device without user interaction, while CVE-2026-113970 is a use-after-free in Bluetooth that could enable memory corruption by an attacker within Bluetooth range.

CVE-2026-113968 (AirPlay) may be exploitable from Bluetooth range, and CVE-2026-113969 (rapportd) requires the attacker to be on the same network to abuse AirPlay pairing codes. CVE-2026-113961 and CVE-2026-113960 relate to iMessage group chats—remote joining or accessing prior messages within a group. CVE-2026-111497 is the Brotli use of the Node2Shell vulnerability, which Apple notes has seen threat actor activity in the wild, although there are no indications of attacks against Apple products.

CVE-2026-113971 affects iOS/iPadOS 18.7.12 on older devices, enabling pairing with an AirPlay receiver from the lock screen after physical access.

Two platform-specific issues also appear: CVE-2026-113963 (App Intents authorization) appears for iOS, iPadOS 27.2.1, watchOS 27.2.1 and visionOS 27.2.1. The advisories note no confirmed exploitation in the wild. The Apple advisories also reference CVE-2026-113961 and -960 as messages-related risks and reiterate the breadth of fixes across the ecosystem.

How the story developed

All 2 articles
Quiet for 2 dayslast report 11 Nov2 articles2 outlets

2 articles from 2 outlets since 10 Nov. Quiet since 11 Nov. This was the 2nd report, 18 hours after the first.

Now10 Nov111213First reportSANS ISC · 10 Nov, 14:01This article2nd of 2 · day 1
  • Tue 10 Nov, 14:01 UTC. SANS ISC, first report. Apple fixes nine flaws in November updates for its devices.
  • Wed 11 Nov, 08:01 UTC. SecurityWeek, its first report on the story. Apple patches Bluetooth and AirPlay pairing flaws across platforms. This article, 2nd of 2.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
Show all 2 articles as a list
  1. Tue 10 NovDay 01
    1. Apple fixes nine flaws in November updates for its devices14:01 · SANS ISC · First report
  2. Wed 11 NovDay 11
    1. Apple patches Bluetooth and AirPlay pairing flaws across platforms08:01 · SecurityWeek · This article, 2nd of 2

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in