Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms

Apple on Monday released security updates for iOS, iPadOS, macOS, watchOS and visionOS to patch 10 vulnerabilities, half of them related to Bluetooth and AirPlay pairing.

Five of the flaws are addressed in all nine releases: iOS and iPadOS 27.2.1, 26.7.3 and 18.7.12; macOS Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3; watchOS 27.2.1 and 26.6.1; and visionOS 27.2.1.

Three of the five involve the limit on pairing code guesses. CVE-2026-113968, an AirPlay bug, may be exploitable from Bluetooth range, while CVE-2026-113969, found in the rapportd component, requires the attacker to be on the same network and concerns AirPlay pairing codes.

The third, CVE-2026-113964 in CoreUtils, pairs the same kind of bypass with a second impact. “An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction,” Apple says.

Another CoreUtils issue, CVE-2026-113965, is described in similar terms: “A malicious Bluetooth device may be able to establish a pairing without user interaction.”

The fifth is CVE-2026-113970, a use-after-free in Bluetooth that could allow an attacker within Bluetooth range to corrupt process memory.

Two Messages vulnerabilities have been patched in many of the operating systems. One of them, CVE-2026-113961, can allow a remote attacker to join an iMessage group chat and receive its messages. The other, CVE-2026-113960, could expose a group’s earlier conversation to people added later.

The same releases also fix CVE-2026-111497, the Brotli vulnerability dubbed Node2Shell, which threat actors have targeted in the wild (although there is no indication of attacks against Apple products).

Two flaws are limited to specific platforms. CVE-2026-113963, an App Intents authorization issue that could give an app access to sensitive user information, is listed only for iOS and iPadOS 27.2.1, watchOS 27.2.1 and visionOS 27.2.1.

CVE-2026-113971 appears only in the iOS and iPadOS 18.7.12 advisory, which covers iPhone XS, XS Max, XR and the seventh-generation iPad. “An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen,” Apple explains.

Apple credits itself for five of the vulnerabilities. An anonymous researcher reported both Messages bugs and CVE-2026-113964, and László Várady is credited for the App Intents flaw.

None of the advisories mention exploitation in the wild. Additional details are available on Apple’s Security Releases page.