Apple’s iOS and iPadOS 27.2.1 update fixes two iMessage group chat privacy flaws and nine Bluetooth and AirPlay pairing bugs, with no known exploitation of the iMessage issues.
The release also covers other Apple platforms. Apple offered no workarounds for any of the flaws, so installing the update is the only remedy.
Two iMessage Group Chat Flaws Expose Private Messages
CVE-2026-113961 is a group chat authorization flaw that allows a remote attacker to join a group chat and receive its messages. Because the attacker needs no prior membership, the flaw undermines the basic expectation that only invited participants can read a conversation.
CVE-2026-113960 affects members who are legitimately added to a group. Under the flaw, a user added to a group can read messages that were sent before they joined, exposing history that participants may have assumed stayed private.
No Exploitation Reported for the iMessage Bugs
There is no known exploitation of either iMessage vulnerability. The reporting does not describe what the attacker would need beyond remote access to a conversation, and no technical details beyond the authorization failures have been published.
Nine Bluetooth and AirPlay Pairing Fixes
The update addresses nine issues in Bluetooth and AirPlay pairing. Two let a malicious Bluetooth device pair with a target without any user interaction. Two others bypass the limits on pairing-code attempts, which would let a nearby attacker try codes without being cut off. One is a memory corruption bug reachable from Bluetooth range.
Proximity Requirement Limits the Bluetooth Pairing Flaws in iOS 27.2.1
These flaws share a requirement: the attacker must be physically near the target device. That limits how widely they can be abused, but they also operate without the victim doing anything, in the case of the no-interaction pairing bugs. Crowded public places are the environments where a nearby attacker is most plausible.
Brotli Decoder Fix and Older Devices Left Without Patches
Apple’s release notes also include CVE-2026-111497, an out-of-bounds write in the Brotli decoder. CISA added that flaw to its Known Exploited Vulnerabilities catalog on October 27, so its appearance in this update does not represent a new exploitation event.
Not all devices received the new fixes. The iPhone XS, XS Max and XR, the iPad 7th generation and select Apple Watch models received updates that do not include these patches. Owners of those devices continue to face the issues, and Apple has offered no mitigation for them.
The gap illustrates a recurring feature of Apple’s support model: older hardware receives security updates, but not necessarily every fix delivered to current models. For users of the excluded devices, the main options are to rely on the limited proximity or access conditions of each flaw or to upgrade hardware.
What Users Should Expect From the 27.2.1 Update
The practical guidance is brief: update iPhones and iPads to iOS or iPadOS 27.2.1. Those running newer hardware receive the full set of fixes, including those that address the group chat authorization issues and the Bluetooth pairing flaws.
The iMessage bugs matter because messaging platforms are common channels for sensitive conversations, and an authorization bypass that lets an outsider into a group chat is a privacy failure even when no code execution is involved. Apple’s update closes both flaws, but group administrators who suspect someone unfamiliar joined a conversation before patching may want to review the membership of sensitive threads.
Scope of the Updates Beyond the iPhone
Apple’s fixes are not limited to iPhones. The advisory covers iOS and iPadOS 27.2.1 and other Apple platforms, with Bluetooth and AirPlay pairing among the components patched. Devices in the excluded group, namely the iPhone XS, XS Max and XR, the iPad 7th generation and select Apple Watch models, are among those that received updates without these patches, and Apple has not said whether further updates will arrive.
