Apple’s iOS 27.2.1 fixes a flaw that let a stranger join an iMessage group chat

Apple’s iOS 27.2.1, released Nov. 9, closes a Messages flaw that let a remote attacker join an iMessage group chat and receive its messages. The update fixes nine vulnerabilities across seven components and runs on iPhone 11 and later. Apple credits the Messages finding to an anonymous researcher.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

A second Messages entry, CVE-2026-113960, covers a related weakness in which a user added to a group could read messages sent before joining. Apple fixed that one by removing the vulnerable code, and fixed the join flaw by tightening an authorization check. Between them the two entries describe a group-chat membership boundary that did not hold up on either side: who may enter, and what a newcomer may see of the past.

The two Messages entries, CVE-2026-113961 and CVE-2026-113960

Apple’s security content page for iOS 27.2.1 describes CVE-2026-113961 in a single line: a remote attacker may be able to join an iMessage group chat and receive its messages. The stated remedy is that “an authorization issue was addressed with improved validation.” Apple does not say how many chats were reachable, whether any real-world abuse occurred, or how an attacker would have located a target group.

Apple’s Platform Security guide treats iMessage as a service of its own, with sections on how messages are sent and received and on the BlastDoor sandbox that handles incoming message content. Group membership sits in the layer above that, which is why an authorization fix, not a sandbox change, was the remedy here. A silent member of a family or work chat would have seen everything posted from then on.

Group chats in iMessage are built on a shared list of members, and every message sent to the group goes to everyone on that list. An authorization check decides who is allowed onto it. If the check can be skirted, the damage is not a single stolen message but a standing seat in a conversation, and the companion flaw meant the seat could come with the chat’s history. Family logistics, workplace discussions and one-time codes pass through such chats every day, which is what makes the membership boundary worth patching quickly.

Bluetooth, AirPlay and rapportd pairing fixes

Four other entries concern pairing. CVE-2026-113964 in CoreUtils lets an attacker within Bluetooth range bypass the pairing-code rate limit and pair without user interaction, and an anonymous researcher is credited. CVE-2026-113965, also CoreUtils, covers a malicious Bluetooth device pairing without interaction. CVE-2026-113968 in AirPlay is a Bluetooth-range bypass of the pairing-code rate limit, and CVE-2026-113969 in rapportd allows the same bypass from the same network. Apple credits itself for those last three and for CVE-2026-113965. CVE-2026-113970 in Bluetooth is a use-after-free that a Bluetooth-range attacker could use to corrupt process memory, another entry Apple credits to itself. A pairing code is short by design, so the rate limit is what stops an attacker from guessing it; a bypass of that limit, within radio range or on the same network, is what the four rate-limit and pairing entries describe. Apple’s page carries no exploitation status for any of them.

The remaining two fixes are CVE-2026-111497, an out-of-bounds write in the brotli compression library that crafted input could trigger, and CVE-2026-113963 in App Intents, where an app could access sensitive user data. App Intents is credited to László Várady. Brotli is a compression format used when apps and websites exchange data, which is why a memory-corruption bug there matters even though the library is rarely seen by users. Apple lists the brotli entry without a named credit, and its page gives the same one-line impact description for each fix, with no severity score attached to any of them.

Installing iOS 27.2.1 on iPhone 11 and later

The update applies to iPhone 11 and later, plus iPad Pro 12.9-inch (4th generation and later), iPad Pro 11-inch (2nd generation and later), iPad Air (4th generation and later), iPad (9th generation and later) and iPad mini (6th generation and later). Apple’s instructions for updating an iPhone or iPad cover installing wirelessly or through a computer and managing automatic updates. iPadOS 27.2.1 shipped alongside, and Apple lists the same nine entries for both operating systems in a single table, with one shared set of eligible devices for every row. Phones older than the iPhone 11 do not appear on the eligibility list for this release.

Apple’s security releases index lists iOS 27.2.1 and iPadOS 27.2.1 on Nov. 9, 2026, and repeats the company’s long-standing line that it does not disclose, discuss or confirm security issues until an investigation has occurred. Researchers who find flaws can submit them through Apple Security Research, where the Apple Security Bounty invites submissions and rewards them.

The security page carries no severity scores and no exploitation status, so whether anyone used the group-join flaw before the patch is not answered by Apple’s record. The anonymous researcher who reported both Messages entries has not been identified, and the credit line gives no name, company or other identifier.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.