CVE-2026-113960 · Vendor
NO FIX YET · SEE WHAT TO DO
A flaw in Apple's Messages app let a person added to an iMessage group read messages sent before they joined. Apple fixed it by removing the vulnerable code in iOS 27.2.1 and iPadOS 27.2.1.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone who uses Messages on an iPhone or iPad running an older iOS or iPadOS version, most of all people in iMessage group chats. Apple's advisory lists the Messages fix for this CVE alongside other flaws in the same release. Devices already on iOS 27.2.1 or iPadOS 27.2.1 are not affected.
Not affected if updated-to-27.2.1
Who cares apple, imessage, ios, ipados, vendor-advisory
27.2.1 on each iPhone or iPad.27.2.127.2.1About the security content of iOS 27.2.1 and iPadOS 27.2.1 - Apple Support
This document describes the security content of iOS 27.2.1 and iPadOS 27.2.1.
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
Released November 9, 2026
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later
Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts
Description: A logic issue was addressed with improved state management.
CVE-2026-113968: Apple
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later
Impact: An app may be able to access sensitive user data
Description: An authorization issue was addressed with improved state management.
CVE-2026-113963: László Várady
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later
Impact: An attacker in Bluetooth range may be able to corrupt process memory
Description: A use-after-free issue was addressed with improved memory management.
CVE-2026-113970: Apple
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later
Impact: Processing maliciously crafted input may lead to memory corruption
Description: An out-of-bounds write issue was addressed with improved input validation.
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later
Impact: A malicious Bluetooth device may be able to establish a pairing without user interaction
Description: This issue was addressed with improved checks.
CVE-2026-113965: Apple
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later
Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction
Description: A logic issue was addressed with improved state management.
CVE-2026-113964: an anonymous researcher
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later
Impact: A remote attacker may be able to join an iMessage group chat and receive its messages
Description: An authorization issue was addressed with improved validation.
CVE-2026-113961: an anonymous researcher
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later
Impact: A user added to an iMessage group may be able to access messages sent before they joined
Description: This issue was addressed by removing the vulnerable code.
CVE-2026-113960: an anonymous researcher
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later
Impact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts
Description: A logic issue was addressed with improved state management.
CVE-2026-113969: Apple
Published Date: November 09, 2026
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.