Summary
Apple released iOS 27.2.1 and iPadOS 27.2.1 on November 9, 2026, addressing nine security issues. The listed fixes cover Messages, Bluetooth and AirPlay, among other components.
Apple released iOS 27.2.1 and iPadOS 27.2.1 on November 9, 2026, with fixes for nine security issues, according to its security notice. The issues affect components including Messages, AirPlay, Bluetooth, App Intents and CoreUtils. Apple describes potential impacts ranging from unauthorised access to iMessage group messages to attacks involving wireless pairing and memory corruption.
What the security fixes address
Two issues concern iMessage groups. Apple says a remote attacker may have been able to join a group chat and receive its messages (CVE-2026-113961). A separate flaw could allow someone added to a group to access messages sent before they joined (CVE-2026-113960). Apple addressed the first with improved validation and the second by removing the vulnerable code.
Several fixes relate to wireless connections and pairing. An attacker within Bluetooth range may have been able to bypass limits on AirPlay pairing-code attempts (CVE-2026-113968). A separate CoreUtils issue could let an attacker in Bluetooth range bypass those limits and pair with a device without user interaction (CVE-2026-113964). Apple also lists a CoreUtils flaw that could let a malicious Bluetooth device establish a pairing without user interaction (CVE-2026-113965). In rapportd, an attacker on the same network may have been able to bypass the rate limit on AirPlay pairing attempts (CVE-2026-113969). Rate limits restrict how frequently pairing codes can be tried.
The Bluetooth fix addresses a use-after-free error, a memory-management flaw that can arise when software continues to use memory after it has been released; Apple says it could allow process memory corruption (CVE-2026-113970). In the Brotli component, processing specially crafted input could cause memory corruption through an out-of-bounds write, in which software writes beyond an intended memory area (CVE-2026-111497). An App Intents authorization flaw could allow an app to access sensitive user data (CVE-2026-113963).
Which devices Apple lists
Apple lists the fixes for iPhone 11 and later; iPad Pro 12.9-inch (4th generation and later); iPad Pro 11-inch (2nd generation and later); iPad Air (4th generation and later); iPad (9th generation and later); and iPad mini (6th generation and later).
The notice describes the security risks as possibilities, rather than reporting that each attack occurred. It identifies the affected components, potential impacts and CVE identifiers, along with brief descriptions of the changes made to address the flaws.