--- id: "CVE-2026-113960" page: "https://infrastack.ai/live/CVE-2026-113960" kind: "vulnerability" aliases: ["CVE-2026-113960"] title: "This issue was addressed by removing the vulnerable code" severity: "medium" cvss: null epss: null exploited: false status: "open" category: "vendor" products: [] ecosystems: [] tags: ["apple", "imessage", "ios", "ipados", "vendor", "vendor-advisory"] not_affected_if: ["updated-to-27.2.1"] published_at: "2026-11-09T00:00:00+00:00" first_seen_at: "2026-11-10T00:15:16+00:00" updated_at: "2026-11-10T00:28:47+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/149715", "first_seen_at": "2026-11-10T00:15:16+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149716", "first_seen_at": "2026-11-10T00:15:16+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149718", "first_seen_at": "2026-11-10T00:15:16+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149719", "first_seen_at": "2026-11-10T00:15:16+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149720", "first_seen_at": "2026-11-10T00:15:16+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149722", "first_seen_at": "2026-11-10T00:15:16+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149724", "first_seen_at": "2026-11-10T00:16:53+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113960", "first_seen_at": "2026-11-10T00:28:47+00:00"}] exploit_sources: [] --- # This issue was addressed by removing the vulnerable code Link for people: https://infrastack.ai/live/CVE-2026-113960 (this .md is for agents) A flaw in Apple's Messages app let a person added to an iMessage group read messages sent before they joined. Apple fixed it by removing the vulnerable code in iOS 27.2.1 and iPadOS 27.2.1. _Summary, check and fix written by a model from the sources; labelled as such._ ## How to check - Compare the installed iOS or iPadOS version with `27.2.1` on each iPhone or iPad. - Affected devices listed by Apple include iPhone 11 and later and iPad Pro, iPad Air, iPad (9th generation and later) and iPad mini (6th generation and later). ## Fix - iOS: `27.2.1` - iPadOS: `27.2.1` ## Timeline - 2026-11-10T00:15:16+00:00 lab https://support.apple.com/en-us/149715 — Apple: About the security content of iOS 27.2.1 and iPadOS 27.2.1 - Apple Support - 2026-11-10T00:15:16+00:00 lab https://support.apple.com/en-us/149716 — Apple: About the security content of iOS 26.7.3 and iPadOS 26.7.3 - Apple Support - 2026-11-10T00:15:16+00:00 lab https://support.apple.com/en-us/149718 — Apple: About the security content of macOS Golden Gate 27.2.1 - Apple Support - 2026-11-10T00:15:16+00:00 lab https://support.apple.com/en-us/149719 — Apple: About the security content of macOS Tahoe 26.7.3 - Apple Support - 2026-11-10T00:15:16+00:00 lab https://support.apple.com/en-us/149720 — Apple: About the security content of macOS Sequoia 15.8.3 - Apple Support - 2026-11-10T00:15:16+00:00 lab https://support.apple.com/en-us/149722 — Apple: About the security content of watchOS 27.2.1 - Apple Support - 2026-11-10T00:16:53+00:00 lab https://support.apple.com/en-us/149724 — Apple: About the security content of visionOS 27.2.1 - Apple Support - 2026-11-10T00:28:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113960 ## Documents - [advisory] Apple: About the security content of macOS Golden Gate 27.2.1 - Apple Support https://support.apple.com/en-us/149718 - [advisory] Apple: About the security content of iOS 27.2.1 and iPadOS 27.2.1 - Apple Support https://support.apple.com/en-us/149715 - [advisory] Apple: About the security content of iOS 26.7.3 and iPadOS 26.7.3 - Apple Support https://support.apple.com/en-us/149716 - [advisory] Apple: About the security content of watchOS 27.2.1 - Apple Support https://support.apple.com/en-us/149722 - [advisory] Apple: About the security content of macOS Tahoe 26.7.3 - Apple Support https://support.apple.com/en-us/149719 - [advisory] Apple: About the security content of macOS Sequoia 15.8.3 - Apple Support https://support.apple.com/en-us/149720 - [advisory] Apple: About the security content of visionOS 27.2.1 - Apple Support https://support.apple.com/en-us/149724 ## From the sources About the security content of iOS 27.2.1 and iPadOS 27.2.1 - Apple Support # About the security content of iOS 27.2.1 and iPadOS 27.2.1 This document describes the security content of iOS 27.2.1 and iPadOS 27.2.1. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## iOS 27.2.1 and iPadOS 27.2.1 Released November 9, 2026 ### AirPlay Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts Description: A logic issue was addressed with improved state management. CVE-2026-113968: Apple ### App Intents Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-113963: László Várady ### Bluetooth Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An attacker in Bluetooth range may be able to corrupt process memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-113970: Apple ### brotli Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: Processing maliciously crafted input may lead to memory corruption Description: An out-of-bounds write issue was addressed with improved input validation. ### CoreUtils Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: A malicious Bluetooth device may be able to establish a pairing without user interaction Description: This issue was addressed with improved checks. CVE-2026-113965: Apple ### CoreUtils Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction Description: A logic issue was addressed with improved state management. CVE-2026-113964: an anonymous researcher ### Messages Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: A remote attacker may be able to join an iMessage group chat and receive its messages Description: An authorization issue was addressed with improved validation. CVE-2026-113961: an anonymous researcher ### Messages Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: A user added to an iMessage group may be able to access messages sent before they joined Description: This issue was addressed by removing the vulnerable code. CVE-2026-113960: an anonymous researcher ### rapportd Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts Description: A logic issue was addressed with improved state management. CVE-2026-113969: Apple Published Date: November 09, 2026 --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_