--- id: "CVE-2026-113963" page: "https://infrastack.ai/live/CVE-2026-113963" kind: "vulnerability" aliases: ["CVE-2026-113963"] title: "An authorization issue was addressed with improved state management" severity: "medium" cvss: 5.5 epss: null exploited: false status: "open" category: "vendor" products: [] ecosystems: [] tags: ["apple", "ios", "ipad", "ipados", "iphone", "vendor", "vendor-advisory"] not_affected_if: ["already-updated"] published_at: "2026-11-09T00:00:00+00:00" first_seen_at: "2026-11-10T00:15:16+00:00" updated_at: "2026-11-10T00:28:47+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/149715", "first_seen_at": "2026-11-10T00:15:16+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149722", "first_seen_at": "2026-11-10T00:15:16+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149724", "first_seen_at": "2026-11-10T00:16:53+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113963", "first_seen_at": "2026-11-10T00:28:47+00:00"}] exploit_sources: [] --- # An authorization issue was addressed with improved state management Link for people: https://infrastack.ai/live/CVE-2026-113963 (this .md is for agents) Apple's 27.2.1 security release for iPhone and iPad fixes several flaws, among them an authorization issue that could let an app reach sensitive user data and a Bluetooth memory corruption bug. The advisory describes the attacker gains only in general terms, and the sources do not name a single CVE-level severity. _Summary, check and fix written by a model from the sources; labelled as such._ ## How to check - Open Settings > General > About on the iPhone or iPad and read the iOS or iPadOS version. - Compare the installed version with `27.2.1` or later. ## Fix - iOS and iPadOS: `27.2.1`, as named in the Apple advisory. ## Timeline - 2026-11-10T00:15:16+00:00 lab https://support.apple.com/en-us/149715 — Apple: About the security content of iOS 27.2.1 and iPadOS 27.2.1 - Apple Support - 2026-11-10T00:15:16+00:00 lab https://support.apple.com/en-us/149722 — Apple: About the security content of watchOS 27.2.1 - Apple Support - 2026-11-10T00:16:53+00:00 lab https://support.apple.com/en-us/149724 — Apple: About the security content of visionOS 27.2.1 - Apple Support - 2026-11-10T00:28:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113963 ## Documents - [advisory] Apple: About the security content of iOS 27.2.1 and iPadOS 27.2.1 - Apple Support https://support.apple.com/en-us/149715 - [advisory] Apple: About the security content of watchOS 27.2.1 - Apple Support https://support.apple.com/en-us/149722 - [advisory] Apple: About the security content of visionOS 27.2.1 - Apple Support https://support.apple.com/en-us/149724 ## From the sources About the security content of iOS 27.2.1 and iPadOS 27.2.1 - Apple Support # About the security content of iOS 27.2.1 and iPadOS 27.2.1 This document describes the security content of iOS 27.2.1 and iPadOS 27.2.1. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## iOS 27.2.1 and iPadOS 27.2.1 Released November 9, 2026 ### AirPlay Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts Description: A logic issue was addressed with improved state management. CVE-2026-113968: Apple ### App Intents Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-113963: László Várady ### Bluetooth Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An attacker in Bluetooth range may be able to corrupt process memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-113970: Apple ### brotli Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: Processing maliciously crafted input may lead to memory corruption Description: An out-of-bounds write issue was addressed with improved input validation. ### CoreUtils Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: A malicious Bluetooth device may be able to establish a pairing without user interaction Description: This issue was addressed with improved checks. CVE-2026-113965: Apple ### CoreUtils Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction Description: A logic issue was addressed with improved state management. CVE-2026-113964: an anonymous researcher ### Messages Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: A remote attacker may be able to join an iMessage group chat and receive its messages Description: An authorization issue was addressed with improved validation. CVE-2026-113961: an anonymous researcher ### Messages Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: A user added to an iMessage group may be able to access messages sent before they joined Description: This issue was addressed by removing the vulnerable code. CVE-2026-113960: an anonymous researcher ### rapportd Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts Description: A logic issue was addressed with improved state management. CVE-2026-113969: Apple Published Date: November 09, 2026 --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_