iOS 27.2.1 security fixes cover nine flaws, and the sharpest one could let a remote attacker join an iMessage group chat and read its messages. Four more fixes stop attackers from guessing pairing codes or pairing with an iPhone or iPad without any prompt.
Apple shipped iOS 27.2.1 and iPadOS 27.2.1 on November 9 with only a one-line note about bug fixes. The nine fixes now published touch seven system components, from AirPlay and Bluetooth to Messages and the brotli compression library. They follow the 163 flaws Apple patched in the iOS 27.2 security fixes on October 26.
iOS 27.2.1 Security Fixes
The first bug, CVE-2026-113961, could let a remote attacker join an iMessage group chat and receive its messages. Apple fixed it with improved validation.
The second, CVE-2026-113960, let anyone added to a group read the messages sent before they joined, and Apple fixed it by removing the vulnerable code. If you use iMessage group chats, these two are the fixes that apply to you directly.
Pairing codes only protect your iPhone or iPad if an attacker cannot keep trying new ones, which is why three of these fixes close ways around the limit on pairing code attempts. The AirPlay bug, CVE-2026-113968, let an attacker in Bluetooth range get around that limit, and the rapportd bug, CVE-2026-113969, let someone on the same network do the same for AirPlay pairing codes.
The two CoreUtils fixes go further. CVE-2026-113964 let an attacker in Bluetooth range get past the same limit and pair without any user interaction, and CVE-2026-113965 let a malicious Bluetooth device pair without any interaction from you. Apple fixed all four pairing bugs with improved state management or improved checks.
The App Intents fix, CVE-2026-113963, stops an app on your iPhone or iPad from reaching sensitive user data. The Bluetooth fix, CVE-2026-113970, closes a use-after-free bug that let an attacker in Bluetooth range corrupt process memory, and the brotli fix, CVE-2026-111497, covers maliciously crafted input that could cause memory corruption through an out-of-bounds write.
Apple credits its own team for four of the nine reports and an anonymous researcher for three. László Várady is credited for the App Intents bug, and the brotli entry has no credit.
All nine fixes apply to the iPhone 11 and later, the iPad Pro 12.9-inch (4th generation and later), iPad Pro 11-inch (2nd generation and later), iPad Air (4th generation and later), iPad (9th generation and later) and iPad mini (6th generation and later). To install the update, open Settings, tap General, then tap Software Update.
