Apple has patched a Messages flaw in iOS 27.2.1 and iPadOS 27.2.1, released on 9 November 2026, which it lists with the impact “A remote attacker may be able to join an iMessage group chat and receive its messages”, according to Apple’s security notes for the two updates.

The entry is tracked as CVE-2026-113961 and credited to an anonymous researcher. Apple describes the repair in one line: “An authorization issue was addressed with improved validation.” The page carries no further technical detail and no account of how an attacker would reach a group conversation.

It is one of nine entries in the release, spread across seven components: AirPlay, App Intents, Bluetooth, brotli, CoreUtils, Messages and rapportd. Messages and CoreUtils account for two entries each.

Two Messages entries, two CVE numbers

The second Messages entry concerns what a participant can see once they are in a thread. Apple states the impact as: “A user added to an iMessage group may be able to access messages sent before they joined.”

That issue is tracked as CVE-2026-113960 and is also credited to an anonymous researcher. Apple’s description reads: “This issue was addressed by removing the vulnerable code.” Elsewhere in the same release, Apple describes its fixes as logic, authorization, input-validation or memory-management changes.

Apple does not link the two Messages entries on the page. Each carries its own CVE identifier, its own one-line impact and its own one-line description, and the company gives no sequence of steps, no proof-of-concept detail and no indication of how long either issue was present in iMessage.

Pairing and rate limits

Four of the nine entries deal with pairing, the step in which two devices agree to trust each other before they exchange data.

Under CoreUtils, Apple lists the impact “A malicious Bluetooth device may be able to establish a pairing without user interaction” and says the issue “was addressed with improved checks”. It is tracked as CVE-2026-113965 and credited to Apple.

A second CoreUtils entry, CVE-2026-113964, is credited to an anonymous researcher. Apple states that “an attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction”, and that “a logic issue was addressed with improved state management”. A rate limit caps how many attempts are allowed within a set period.

The AirPlay entry, CVE-2026-113968, covers the rate limit without the pairing step: “An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts.” Apple again describes a logic issue addressed with improved state management, and credits itself.

A separate entry under rapportd, CVE-2026-113969, places the same weakness on the local network. Apple’s impact line reads: “An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts.” It is described as a logic issue addressed with improved state management and credited to Apple.

One further Bluetooth entry concerns memory rather than pairing. CVE-2026-113970 covers an attacker in Bluetooth range who “may be able to corrupt process memory”, described as a use-after-free issue addressed with improved memory management and credited to Apple.

Apple’s wording separates the positions an attacker would need to occupy. Three entries specify an attacker in Bluetooth range, one specifies an attacker on the same network, and the first CoreUtils entry specifies a malicious Bluetooth device. The Messages group-chat entry is the only one on the page that names a remote attacker.

Which iPhones and iPads the update covers

Every entry on the page carries the same availability line. The update applies to iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. Apple lists no separate builds for other hardware on this page.

Two entries sit outside the Messages and pairing groups. Under App Intents, Apple says “an app may be able to access sensitive user data” and that “an authorization issue was addressed with improved state management”. That entry is CVE-2026-113963, credited to László Várady. Under brotli, a compression library, Apple says “processing maliciously crafted input may lead to memory corruption” and describes an out-of-bounds write addressed with improved input validation, tracked as CVE-2026-111497.

Of the nine entries, Apple credits four to itself and three to an anonymous researcher. One is credited to Várady, and the brotli entry lists no researcher.

The page does not state that any of the issues were used against users. Apple’s standing policy, printed at the top of each of these documents, is that the company “doesn’t disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available”, and that Apple security documents reference vulnerabilities by CVE-ID when possible. Recent releases are listed on the Apple security releases page, and the document points readers to the Apple Product Security page for more on security.

Apple published the document on 9 November 2026, the same day it released the updates. The page gives one line of impact and one line of description for each of the nine entries, and lists no mitigation other than the updates themselves.