iOS 27.2.1 fixes an iMessage group chat flaw and Bluetooth pairing bugs
Apple released iOS 27.2.1 and iPadOS 27.2.1 on Monday, November 9, with fixes for 9 security flaws, including one that could let a remote attacker join an iMessage group chat and read its messages. Two Bluetooth pairing bugs could also let a nearby attacker pair with your iPhone without any action from you.
The iMessage bugs
Apple's security notes list 2 flaws in Messages. The more serious one, CVE-2026-113961, is an authorization issue that Apple says may let a remote attacker join an iMessage group chat and receive its messages. Apple fixed it with improved validation.
The second, CVE-2026-113960, may let someone who is added to an iMessage group access messages sent before they joined. Apple says it fixed the issue by removing the vulnerable code. Apple credits both bugs to anonymous researchers.
Bluetooth and AirPlay fixes
Most of the remaining fixes involve Bluetooth and AirPlay. According to Apple:
- CoreUtils (CVE-2026-113965): a malicious Bluetooth device may be able to pair without user interaction.
- CoreUtils (CVE-2026-113964): an attacker in Bluetooth range may be able to get around the limit on pairing code attempts and pair without user interaction.
- AirPlay (CVE-2026-113968): an attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts.
- rapportd (CVE-2026-113969): an attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts.
- Bluetooth (CVE-2026-113970): a use-after-free bug that may let an attacker in Bluetooth range corrupt process memory.
The update also fixes an out-of-bounds write in the brotli component that could cause memory corruption when processing malicious input. An App Intents bug that may let an app access sensitive user data is fixed too. Apple's own release notes describe 27.2.1 only as bug fixes and security updates, with no new features.
Apple doesn't say that any of these flaws has been exploited in attacks. That makes this a routine but worthwhile update rather than an emergency patch.
Which devices get it
iOS 27.2.1 is available for the iPhone 11 and later. iPadOS 27.2.1 covers these iPads:
- iPad Pro 12.9-inch (4th generation) and later
- iPad Pro 11-inch (2nd generation) and later
- iPad Air (4th generation) and later
- iPad (9th generation) and later
- iPad mini (6th generation) and later
Apple released iOS 26.7.3 and iPadOS 26.7.3 the same day for people who haven't moved to iOS 27, and for older iPads that iPadOS 27 doesn't support. That update carries the same Messages, Bluetooth, AirPlay, rapportd and brotli fixes, though not the App Intents one. It runs on the iPhone 11 and later. On iPad, it covers one generation further back in each line:
- iPad Pro 12.9-inch (3rd generation) and later
- iPad Pro 11-inch (1st generation) and later
- iPad Air (3rd generation) and later
- iPad (8th generation) and later
- iPad mini (5th generation) and later
Macs get the same Messages and Bluetooth fixes in macOS Golden Gate 27.2.1, also released November 9.
What it means for you
Install the update, especially if you use iMessage group chats or often carry your iPhone in public places where a stranger could be within Bluetooth range. Back up your iPhone first, then go to Settings, then General, then Software Update, and tap Download and Install. Our guide on how to update your iPhone walks through it, including what to do if the update doesn't appear.
If you own an older iPad, such as an iPad (8th generation) or iPad mini (5th generation), look for iPadOS 26.7.3 instead. It brings those models most of the same protection. Turning on automatic updates in the Software Update menu means future security fixes install without you having to remember.