{"id":"CVE-2026-113964","kind":"vulnerability","aliases":["CVE-2026-113964"],"related":[],"title":"A logic issue was addressed with improved state management","description":"About the security content of iOS 27.2.1 and iPadOS 27.2.1 - Apple Support\n\n# About the security content of iOS 27.2.1 and iPadOS 27.2.1\n\nThis document describes the security content of iOS 27.2.1 and iPadOS 27.2.1.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 27.2.1 and iPadOS 27.2.1\n\nReleased November 9, 2026\n\n### AirPlay\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113968: Apple\n\n### App Intents\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-113963: László Várady\n\n### Bluetooth\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An attacker in Bluetooth range may be able to corrupt process memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-113970: Apple\n\n### brotli\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing maliciously crafted input may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\n### CoreUtils\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A malicious Bluetooth device may be able to establish a pairing without user interaction\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-113965: Apple\n\n### CoreUtils\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113964: an anonymous researcher\n\n### Messages\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A remote attacker may be able to join an iMessage group chat and receive its messages\n\nDescription: An authorization issue was addressed with improved validation.\n\nCVE-2026-113961: an anonymous researcher\n\n### Messages\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A user added to an iMessage group may be able to access messages sent before they joined\n\nDescription: This issue was addressed by removing the vulnerable code.\n\nCVE-2026-113960: an anonymous researcher\n\n### rapportd\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113969: Apple\n\n Published Date: November 09, 2026","summary":"Apple's iOS 27.2.1 and iPadOS 27.2.1 release fixes a CoreUtils flaw in Bluetooth pairing. An attacker within Bluetooth range can bypass the pairing-code rate limit and pair with a device without user interaction.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","bluetooth","infrastructure","ios","ipad","ipados","iphone","vendor-advisory"],"not_affected_if":["already-on-27.2.1","unsupported-model"],"how_to_check":"- Check the iOS or iPadOS version on each device: anything below `27.2.1` is in scope.\n- Check the device model against the advisory's 'Available for' list (iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, and others).","fix":"- iOS: `27.2.1`\n- iPadOS: `27.2.1`","status":"open","published_at":"2026-11-09T00:00:00+00:00","first_seen_at":"2026-11-10T00:15:16+00:00","triaged_at":"2026-11-10T00:17:46+00:00","updated_at":"2026-11-10T00:28:47+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T00:17:46Z","model":"claude-haiku-5-5","output":{"fix":"- iOS: `27.2.1`\n- iPadOS: `27.2.1`","reach":"local","title":"iOS and iPadOS: Bluetooth pairing rate limit bypass allows pairing without consent","impact":"medium","summary":"Apple's iOS 27.2.1 and iPadOS 27.2.1 release fixes a CoreUtils flaw in Bluetooth pairing. An attacker within Bluetooth range can bypass the pairing-code rate limit and pair with a device without user interaction.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["ios","ipados","bluetooth","iphone","ipad"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"nearby attacker pairs with device without user interaction","analyst_note":"","how_to_check":"- Check the iOS or iPadOS version on each device: anything below `27.2.1` is in scope.\n- Check the device model against the advisory's 'Available for' list (iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, and others).","plain_action":"Install iOS 27.2.1 on your iPhone or iPadOS 27.2.1 on your iPad.","product_name":"","needs_analyst":false,"not_affected_if":["already-on-27.2.1","unsupported-model"],"who_is_affected":"Devices running iOS or iPadOS builds before 27.2.1 on the models listed in the advisory. The attacker must be within Bluetooth range of the device, and the sources do not say whether Bluetooth must be enabled or paired beforehand. Devices already on 27.2.1 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001957,"input_tokens":6687,"output_tokens":2577,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113961':662C '-113963':303C '-113964':12A,15A,589C '-113965':508C '-113968':236C '-113970':375C '-2026':11A,14A,235C,302C,374C,507C,588C,661C '11':169C,182C,243C,256C,310C,323C,381C,394C,446C,459C,514C,527C,597C,610C,670C,683C '12.9':174C,248C,315C,386C,451C,519C,602C,675C '2026':164C '27.2.1':29B,32B,68C,71C,80C,83C,92C,95C,157C,160C '2nd':184C,258C,325C,396C,461C,529C,612C,685C '4th':176C,190C,250C,264C,317C,331C,388C,402C,453C,467C,521C,535C,604C,618C,677C,691C '6th':202C,276C,343C,414C,479C,547C,630C '9':163C '9th':195C,269C,336C,407C,472C,540C,623C,696C 'abl':214C,285C,355C,490C,559C,640C 'access':287C 'address':5A,229C,296C,368C,437C,502C,582C,656C 'advisori':25B 'air':189C,263C,330C,401C,466C,534C,617C,690C 'airplay':165C 'anonym':591C,664C 'app':238C,282C 'appl':16B,26B,72C,97C,104C,130C,134C,152C,237C,376C,509C 'attack':42B,208C,349C,553C,637C 'attempt':223C,568C 'author':293C,653C 'avail':123C,166C,240C,307C,378C,443C,511C,594C,667C 'bluetooth':17B,39B,44B,210C,306C,351C,486C,555C 'bound':433C 'brot':377C 'bypass':47B,216C,561C 'chat':646C 'check':505C 'code':51B,222C,567C 'confirm':110C 'content':65C,77C,89C 'coreutil':36B,442C,510C 'corrupt':357C,427C 'craft':421C 'custom':102C 'cve':10A,13A,141C,234C,301C,373C,506C,587C,660C 'cve-id':140C 'data':290C 'describ':86C 'descript':224C,291C,360C,428C,498C,577C,651C 'devic':58B,487C,573C 'disclos':107C 'discuss':108C 'document':85C,136C 'doesn':105C 'establish':492C 'fix':34B 'flaw':37B 'free':365C 'generat':177C,185C,191C,196C,203C,251C,259C,265C,270C,277C,318C,326C,332C,337C,344C,389C,397C,403C,408C,415C,454C,462C,468C,473C,480C,522C,530C,536C,541C,548C,605C,613C,619C,624C,631C,678C,686C,692C,697C 'group':645C 'id':142C 'imessag':644C 'impact':206C,280C,347C,418C,483C,551C,634C 'improv':7A,231C,298C,370C,439C,504C,584C,658C 'inch':175C,183C,249C,257C,316C,324C,387C,395C,452C,460C,520C,528C,603C,611C,676C,684C 'inform':147C 'infrastructur':18B 'input':422C,440C 'intent':239C 'interact':61B,497C,576C 'investig':115C 'io':19B,28B,67C,79C,91C,156C 'ipad':20B,172C,180C,188C,194C,200C,246C,254C,262C,268C,274C,313C,321C,329C,335C,341C,384C,392C,400C,406C,412C,449C,457C,465C,471C,477C,517C,525C,533C,539C,545C,600C,608C,616C,622C,628C,673C,681C,689C,695C 'ipado':21B,31B,70C,82C,94C,159C 'iphon':22B,168C,242C,309C,380C,445C,513C,596C,669C 'issu':3A,112C,227C,294C,366C,435C,500C,580C,654C 'join':642C 'later':171C,179C,187C,193C,198C,205C,245C,253C,261C,267C,272C,279C,312C,320C,328C,334C,339C,346C,383C,391C,399C,405C,410C,417C,448C,456C,464C,470C,475C,482C,516C,524C,532C,538C,543C,550C,599C,607C,615C,621C,626C,633C,672C,680C,688C,694C,699C 'lead':424C 'limit':53B,219C,564C 'list':127C 'logic':2A,226C,579C 'lászló':304C 'malici':420C,485C 'manag':9A,233C,300C,372C,586C 'may':212C,283C,353C,423C,488C,557C,638C 'memori':359C,371C,426C 'messag':593C,650C,666C 'mini':201C,275C,342C,413C,478C,546C,629C 'novemb':162C 'occur':117C 'out-of-bound':430C 'page':133C,155C 'pair':40B,50B,55B,221C,494C,566C,570C 'pairing-cod':49B 'patch':119C 'possibl':144C 'pro':173C,181C,247C,255C,314C,322C,385C,393C,450C,458C,518C,526C,601C,609C,674C,682C 'process':358C,419C 'product':153C 'protect':103C 'rang':45B,211C,352C,556C 'rate':52B,218C,563C 'receiv':648C 'recent':124C 'refer':137C 'releas':33B,121C,125C,132C,161C 'remot':636C 'research':592C,665C 'secur':64C,76C,88C,98C,111C,131C,135C,149C,154C 'see':150C 'sensit':288C 'state':8A,232C,299C,585C 'support':73C 'updat':99C 'use':363C 'use-after-fre':362C 'user':60B,289C,496C,575C 'valid':441C,659C 'vendor':24B 'vendor-advisori':23B 'vulner':138C 'váradi':305C 'within':43B 'without':59B,495C,574C 'write':434C","nicknames":[],"mitigations":[],"who_affected":"Devices running iOS or iPadOS builds before 27.2.1 on the models listed in the advisory. The attacker must be within Bluetooth range of the device, and the sources do not say whether Bluetooth must be enabled or paired beforehand. Devices already on 27.2.1 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Install iOS 27.2.1 on your iPhone or iPadOS 27.2.1 on your iPad.","pkeys":[],"ptokens":[],"labels":["apple","bluetooth","infrastructure","ios","ipad","ipados","iphone","medium","vendoradvisory"],"campaign_type":null,"search_a":"'-113964':12A,15A '-2026':11A,14A 'address':5A 'cve':10A,13A 'improv':7A 'issu':3A 'logic':2A 'manag':9A 'state':8A","search_b":"'27.2.1':29B,32B 'advisori':25B 'appl':16B,26B 'attack':42B 'bluetooth':17B,39B,44B 'bypass':47B 'code':51B 'coreutil':36B 'devic':58B 'fix':34B 'flaw':37B 'infrastructur':18B 'interact':61B 'io':19B,28B 'ipad':20B 'ipado':21B,31B 'iphon':22B 'limit':53B 'pair':40B,50B,55B 'pairing-cod':49B 'rang':45B 'rate':52B 'releas':33B 'user':60B 'vendor':24B 'vendor-advisori':23B 'within':43B 'without':59B","search_c":"'-113961':662C '-113963':303C '-113964':589C '-113965':508C '-113968':236C '-113970':375C '-2026':235C,302C,374C,507C,588C,661C '11':169C,182C,243C,256C,310C,323C,381C,394C,446C,459C,514C,527C,597C,610C,670C,683C '12.9':174C,248C,315C,386C,451C,519C,602C,675C '2026':164C '27.2.1':68C,71C,80C,83C,92C,95C,157C,160C '2nd':184C,258C,325C,396C,461C,529C,612C,685C '4th':176C,190C,250C,264C,317C,331C,388C,402C,453C,467C,521C,535C,604C,618C,677C,691C '6th':202C,276C,343C,414C,479C,547C,630C '9':163C '9th':195C,269C,336C,407C,472C,540C,623C,696C 'abl':214C,285C,355C,490C,559C,640C 'access':287C 'address':229C,296C,368C,437C,502C,582C,656C 'air':189C,263C,330C,401C,466C,534C,617C,690C 'airplay':165C 'anonym':591C,664C 'app':238C,282C 'appl':72C,97C,104C,130C,134C,152C,237C,376C,509C 'attack':208C,349C,553C,637C 'attempt':223C,568C 'author':293C,653C 'avail':123C,166C,240C,307C,378C,443C,511C,594C,667C 'bluetooth':210C,306C,351C,486C,555C 'bound':433C 'brot':377C 'bypass':216C,561C 'chat':646C 'check':505C 'code':222C,567C 'confirm':110C 'content':65C,77C,89C 'coreutil':442C,510C 'corrupt':357C,427C 'craft':421C 'custom':102C 'cve':141C,234C,301C,373C,506C,587C,660C 'cve-id':140C 'data':290C 'describ':86C 'descript':224C,291C,360C,428C,498C,577C,651C 'devic':487C,573C 'disclos':107C 'discuss':108C 'document':85C,136C 'doesn':105C 'establish':492C 'free':365C 'generat':177C,185C,191C,196C,203C,251C,259C,265C,270C,277C,318C,326C,332C,337C,344C,389C,397C,403C,408C,415C,454C,462C,468C,473C,480C,522C,530C,536C,541C,548C,605C,613C,619C,624C,631C,678C,686C,692C,697C 'group':645C 'id':142C 'imessag':644C 'impact':206C,280C,347C,418C,483C,551C,634C 'improv':231C,298C,370C,439C,504C,584C,658C 'inch':175C,183C,249C,257C,316C,324C,387C,395C,452C,460C,520C,528C,603C,611C,676C,684C 'inform':147C 'input':422C,440C 'intent':239C 'interact':497C,576C 'investig':115C 'io':67C,79C,91C,156C 'ipad':172C,180C,188C,194C,200C,246C,254C,262C,268C,274C,313C,321C,329C,335C,341C,384C,392C,400C,406C,412C,449C,457C,465C,471C,477C,517C,525C,533C,539C,545C,600C,608C,616C,622C,628C,673C,681C,689C,695C 'ipado':70C,82C,94C,159C 'iphon':168C,242C,309C,380C,445C,513C,596C,669C 'issu':112C,227C,294C,366C,435C,500C,580C,654C 'join':642C 'later':171C,179C,187C,193C,198C,205C,245C,253C,261C,267C,272C,279C,312C,320C,328C,334C,339C,346C,383C,391C,399C,405C,410C,417C,448C,456C,464C,470C,475C,482C,516C,524C,532C,538C,543C,550C,599C,607C,615C,621C,626C,633C,672C,680C,688C,694C,699C 'lead':424C 'limit':219C,564C 'list':127C 'logic':226C,579C 'lászló':304C 'malici':420C,485C 'manag':233C,300C,372C,586C 'may':212C,283C,353C,423C,488C,557C,638C 'memori':359C,371C,426C 'messag':593C,650C,666C 'mini':201C,275C,342C,413C,478C,546C,629C 'novemb':162C 'occur':117C 'out-of-bound':430C 'page':133C,155C 'pair':221C,494C,566C,570C 'patch':119C 'possibl':144C 'pro':173C,181C,247C,255C,314C,322C,385C,393C,450C,458C,518C,526C,601C,609C,674C,682C 'process':358C,419C 'product':153C 'protect':103C 'rang':211C,352C,556C 'rate':218C,563C 'receiv':648C 'recent':124C 'refer':137C 'releas':121C,125C,132C,161C 'remot':636C 'research':592C,665C 'secur':64C,76C,88C,98C,111C,131C,135C,149C,154C 'see':150C 'sensit':288C 'state':232C,299C,585C 'support':73C 'updat':99C 'use':363C 'use-after-fre':362C 'user':289C,496C,575C 'valid':441C,659C 'vulner':138C 'váradi':305C 'without':495C,574C 'write':434C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"lab","external_id":"https://support.apple.com/en-us/149715#CVE-2026-113964","url":"https://support.apple.com/en-us/149715","severity":null,"published_at":"2026-11-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-10T00:15:16+00:00","fetched_at":"2026-11-10T00:15:16+00:00","note":"Apple: About the security content of iOS 27.2.1 and iPadOS 27.2.1 - Apple Support"},{"source":"lab","external_id":"https://support.apple.com/en-us/149716#CVE-2026-113964","url":"https://support.apple.com/en-us/149716","severity":null,"published_at":"2026-11-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-10T00:15:16+00:00","fetched_at":"2026-11-10T00:15:16+00:00","note":"Apple: About the security content of iOS 26.7.3 and iPadOS 26.7.3 - Apple Support"},{"source":"lab","external_id":"https://support.apple.com/en-us/149717#CVE-2026-113964","url":"https://support.apple.com/en-us/149717","severity":null,"published_at":"2026-11-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-10T00:15:16+00:00","fetched_at":"2026-11-10T00:15:16+00:00","note":"Apple: About the security content of iOS 18.7.12 and iPadOS 18.7.12 - Apple Support"},{"source":"lab","external_id":"https://support.apple.com/en-us/149718#CVE-2026-113964","url":"https://support.apple.com/en-us/149718","severity":null,"published_at":"2026-11-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-10T00:15:16+00:00","fetched_at":"2026-11-10T00:15:16+00:00","note":"Apple: About the security content of macOS Golden Gate 27.2.1 - Apple Support"},{"source":"lab","external_id":"https://support.apple.com/en-us/149719#CVE-2026-113964","url":"https://support.apple.com/en-us/149719","severity":null,"published_at":"2026-11-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-10T00:15:16+00:00","fetched_at":"2026-11-10T00:15:16+00:00","note":"Apple: About the security content of macOS Tahoe 26.7.3 - Apple Support"},{"source":"lab","external_id":"https://support.apple.com/en-us/149720#CVE-2026-113964","url":"https://support.apple.com/en-us/149720","severity":null,"published_at":"2026-11-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-10T00:15:16+00:00","fetched_at":"2026-11-10T00:15:16+00:00","note":"Apple: About the security content of macOS Sequoia 15.8.3 - Apple Support"},{"source":"lab","external_id":"https://support.apple.com/en-us/149722#CVE-2026-113964","url":"https://support.apple.com/en-us/149722","severity":null,"published_at":"2026-11-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-10T00:15:16+00:00","fetched_at":"2026-11-10T00:15:16+00:00","note":"Apple: About the security content of watchOS 27.2.1 - Apple Support"},{"source":"lab","external_id":"https://support.apple.com/en-us/149723#CVE-2026-113964","url":"https://support.apple.com/en-us/149723","severity":null,"published_at":"2026-11-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-10T00:15:17+00:00","fetched_at":"2026-11-10T00:15:17+00:00","note":"Apple: About the security content of watchOS 26.6.1 - Apple Support"},{"source":"lab","external_id":"https://support.apple.com/en-us/149724#CVE-2026-113964","url":"https://support.apple.com/en-us/149724","severity":null,"published_at":"2026-11-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-10T00:16:53+00:00","fetched_at":"2026-11-10T00:16:53+00:00","note":"Apple: About the security content of visionOS 27.2.1 - Apple Support"},{"source":"nvd","external_id":"CVE-2026-113964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113964","severity":null,"published_at":"2026-11-09T22:18:26+00:00","modified_at":"2026-11-09T22:18:26+00:00","first_seen_at":"2026-11-10T00:28:47+00:00","fetched_at":"2026-11-10T00:28:47+00:00","note":null}],"documents":[{"id":111384,"url":"https://support.apple.com/en-us/149723","title":"Apple: About the security content of watchOS 26.6.1 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of watchOS 26.6.1 - Apple Support\n\n# About the security content of watchOS 26.6.1\n\nThis document describes the security content of watchOS 26.6.1.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## watchOS 26.6.1\n\nReleased November 9, 2026\n\n### AirPlay\n\nAvailable for: Apple Watch Series 6, Apple Watch Series 7, Apple Watch Series 8, Apple Watch SE (2nd generation), and Apple Watch Ultra\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113968: Apple\n\n### Bluetooth\n\nAvailable for: Apple Watch Series 6, Apple Watch Series 7, Apple Watch Series 8, Apple Watch SE (2nd generation), and Apple Watch Ultra\n\nImpact: An attacker in Bluetooth range may be able to corrupt process memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-113970: Apple\n\n### CoreUtils\n\nAvailable for: Apple Watch Series 6, Apple Watch Series 7, Apple Watch Series 8, Apple Watch SE (2nd generation), and Apple Watch Ultra\n\nImpact: A malicious Bluetooth device may be able to establish a pairing without user interaction\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-113965: Apple\n\n### CoreUtils\n\nAvailable for: Apple Watch Series 6, Apple Watch Series 7, Apple Watch Series 8, Apple Watch SE (2nd generation), and Apple Watch Ultra\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113964: an anonymous researcher\n\n### rapportd\n\nAvailable for: Apple Watch Series 6, Apple Watch Series 7, Apple Watch Series 8, Apple Watch SE (2nd generation), and Apple Watch Ultra\n\nImpact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113969: Apple\n\n Published Date: November 10, 2026","published_at":"2026-11-10T00:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":111377,"url":"https://support.apple.com/en-us/149715","title":"Apple: About the security content of iOS 27.2.1 and iPadOS 27.2.1 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of iOS 27.2.1 and iPadOS 27.2.1 - Apple Support\n\n# About the security content of iOS 27.2.1 and iPadOS 27.2.1\n\nThis document describes the security content of iOS 27.2.1 and iPadOS 27.2.1.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 27.2.1 and iPadOS 27.2.1\n\nReleased November 9, 2026\n\n### AirPlay\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113968: Apple\n\n### App Intents\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-113963: László Várady\n\n### Bluetooth\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An attacker in Bluetooth range may be able to corrupt process memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-113970: Apple\n\n### brotli\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: Processing maliciously crafted input may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\n### CoreUtils\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A malicious Bluetooth device may be able to establish a pairing without user interaction\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-113965: Apple\n\n### CoreUtils\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113964: an anonymous researcher\n\n### Messages\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A remote attacker may be able to join an iMessage group chat and receive its messages\n\nDescription: An authorization issue was addressed with improved validation.\n\nCVE-2026-113961: an anonymous researcher\n\n### Messages\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: A user added to an iMessage group may be able to access messages sent before they joined\n\nDescription: This issue was addressed by removing the vulnerable code.\n\nCVE-2026-113960: an anonymous researcher\n\n### rapportd\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later\n\nImpact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113969: Apple\n\n Published Date: November 09, 2026","published_at":"2026-11-09T00:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":111378,"url":"https://support.apple.com/en-us/149716","title":"Apple: About the security content of iOS 26.7.3 and iPadOS 26.7.3 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of iOS 26.7.3 and iPadOS 26.7.3 - Apple Support\n\n# About the security content of iOS 26.7.3 and iPadOS 26.7.3\n\nThis document describes the security content of iOS 26.7.3 and iPadOS 26.7.3.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 26.7.3 and iPadOS 26.7.3\n\nReleased November 9, 2026\n\n### AirPlay\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113968: Apple\n\n### Bluetooth\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An attacker in Bluetooth range may be able to corrupt process memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-113970: Apple\n\n### brotli\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: Processing maliciously crafted input may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\n### CoreUtils\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A malicious Bluetooth device may be able to establish a pairing without user interaction\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-113965: Apple\n\n### CoreUtils\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113964: an anonymous researcher\n\n### Messages\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A user added to an iMessage group may be able to access messages sent before they joined\n\nDescription: This issue was addressed by removing the vulnerable code.\n\nCVE-2026-113960: an anonymous researcher\n\n### Messages\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: A remote attacker may be able to join an iMessage group chat and receive its messages\n\nDescription: An authorization issue was addressed with improved validation.\n\nCVE-2026-113961: an anonymous researcher\n\n### rapportd\n\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later\n\nImpact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113969: Apple\n\n Published Date: November 09, 2026","published_at":"2026-11-09T00:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":111379,"url":"https://support.apple.com/en-us/149717","title":"Apple: About the security content of iOS 18.7.12 and iPadOS 18.7.12 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of iOS 18.7.12 and iPadOS 18.7.12 - Apple Support\n\n# About the security content of iOS 18.7.12 and iPadOS 18.7.12\n\nThis document describes the security content of iOS 18.7.12 and iPadOS 18.7.12.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 18.7.12 and iPadOS 18.7.12\n\nReleased November 9, 2026\n\n### AirPlay\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113968: Apple\n\n### Bluetooth\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: An attacker in Bluetooth range may be able to corrupt process memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-113970: Apple\n\n### CoreUtils\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: A malicious Bluetooth device may be able to establish a pairing without user interaction\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-113965: Apple\n\n### CoreUtils\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113964: an anonymous researcher\n\n### MediaRemote\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen\n\nDescription: This issue was addressed by restricting options offered on a locked device.\n\nCVE-2026-113971: Apple\n\n### rapportd\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113969: Apple\n\n Published Date: November 09, 2026","published_at":"2026-11-09T00:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":111380,"url":"https://support.apple.com/en-us/149718","title":"Apple: About the security content of macOS Golden Gate 27.2.1 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of macOS Golden Gate 27.2.1 - Apple Support\n\n# About the security content of macOS Golden Gate 27.2.1\n\nThis document describes the security content of macOS Golden Gate 27.2.1.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## macOS Golden Gate 27.2.1\n\nReleased November 9, 2026\n\n### AirPlay\n\nAvailable for: macOS Golden Gate\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113968: Apple\n\n### Bluetooth\n\nAvailable for: macOS Golden Gate\n\nImpact: An attacker in Bluetooth range may be able to corrupt process memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-113970: Apple\n\n### brotli\n\nAvailable for: macOS Golden Gate\n\nImpact: Processing maliciously crafted input may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-111497\n\n### CoreUtils\n\nAvailable for: macOS Golden Gate\n\nImpact: A malicious Bluetooth device may be able to establish a pairing without user interaction\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-113965: Apple\n\n### CoreUtils\n\nAvailable for: macOS Golden Gate\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113964: an anonymous researcher\n\n### Messages\n\nAvailable for: macOS Golden Gate\n\nImpact: A remote attacker may be able to join an iMessage group chat and receive its messages\n\nDescription: An authorization issue was addressed with improved validation.\n\nCVE-2026-113961: an anonymous researcher\n\n### Messages\n\nAvailable for: macOS Golden Gate\n\nImpact: A user added to an iMessage group may be able to access messages sent before they joined\n\nDescription: This issue was addressed by removing the vulnerable code.\n\nCVE-2026-113960: an anonymous researcher\n\n### rapportd\n\nAvailable for: macOS Golden Gate\n\nImpact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113969: Apple\n\n Published Date: November 09, 2026","published_at":"2026-11-09T00:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":111381,"url":"https://support.apple.com/en-us/149719","title":"Apple: About the security content of macOS Tahoe 26.7.3 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of macOS Tahoe 26.7.3 - Apple Support\n\n# About the security content of macOS Tahoe 26.7.3\n\nThis document describes the security content of macOS Tahoe 26.7.3.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## macOS Tahoe 26.7.3\n\nReleased November 9, 2026\n\n### AirPlay\n\nAvailable for: macOS Tahoe\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113968: Apple\n\n### Bluetooth\n\nAvailable for: macOS Tahoe\n\nImpact: An attacker in Bluetooth range may be able to corrupt process memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-113970: Apple\n\n### brotli\n\nAvailable for: macOS Tahoe\n\nImpact: Processing maliciously crafted input may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-111497\n\n### CoreUtils\n\nAvailable for: macOS Tahoe\n\nImpact: A malicious Bluetooth device may be able to establish a pairing without user interaction\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-113965: Apple\n\n### CoreUtils\n\nAvailable for: macOS Tahoe\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113964: an anonymous researcher\n\n### Messages\n\nAvailable for: macOS Tahoe\n\nImpact: A user added to an iMessage group may be able to access messages sent before they joined\n\nDescription: This issue was addressed by removing the vulnerable code.\n\nCVE-2026-113960: an anonymous researcher\n\n### Messages\n\nAvailable for: macOS Tahoe\n\nImpact: A remote attacker may be able to join an iMessage group chat and receive its messages\n\nDescription: An authorization issue was addressed with improved validation.\n\nCVE-2026-113961: an anonymous researcher\n\n### rapportd\n\nAvailable for: macOS Tahoe\n\nImpact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113969: Apple\n\n Published Date: November 09, 2026","published_at":"2026-11-09T00:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":111382,"url":"https://support.apple.com/en-us/149720","title":"Apple: About the security content of macOS Sequoia 15.8.3 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of macOS Sequoia 15.8.3 - Apple Support\n\n# About the security content of macOS Sequoia 15.8.3\n\nThis document describes the security content of macOS Sequoia 15.8.3.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## macOS Sequoia 15.8.3\n\nReleased November 9, 2026\n\n### AirPlay\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113968: Apple\n\n### Bluetooth\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker in Bluetooth range may be able to corrupt process memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-113970: Apple\n\n### brotli\n\nAvailable for: macOS Sequoia\n\nImpact: Processing maliciously crafted input may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-111497\n\n### CoreUtils\n\nAvailable for: macOS Sequoia\n\nImpact: A malicious Bluetooth device may be able to establish a pairing without user interaction\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-113965: Apple\n\n### CoreUtils\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113964: an anonymous researcher\n\n### Messages\n\nAvailable for: macOS Sequoia\n\nImpact: A user added to an iMessage group may be able to access messages sent before they joined\n\nDescription: This issue was addressed by removing the vulnerable code.\n\nCVE-2026-113960: an anonymous researcher\n\n### Messages\n\nAvailable for: macOS Sequoia\n\nImpact: A remote attacker may be able to join an iMessage group chat and receive its messages\n\nDescription: An authorization issue was addressed with improved validation.\n\nCVE-2026-113961: an anonymous researcher\n\n### rapportd\n\nAvailable for: macOS Sequoia\n\nImpact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113969: Apple\n\n Published Date: November 09, 2026","published_at":"2026-11-09T00:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":111383,"url":"https://support.apple.com/en-us/149722","title":"Apple: About the security content of watchOS 27.2.1 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of watchOS 27.2.1 - Apple Support\n\n# About the security content of watchOS 27.2.1\n\nThis document describes the security content of watchOS 27.2.1.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## watchOS 27.2.1\n\nReleased November 9, 2026\n\n### AirPlay\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113968: Apple\n\n### App Intents\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-113963: László Várady\n\n### Bluetooth\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An attacker in Bluetooth range may be able to corrupt process memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-113970: Apple\n\n### brotli\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: Processing maliciously crafted input may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-111497\n\n### CoreUtils\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: A malicious Bluetooth device may be able to establish a pairing without user interaction\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-113965: Apple\n\n### CoreUtils\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113964: an anonymous researcher\n\n### Messages\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: A remote attacker may be able to join an iMessage group chat and receive its messages\n\nDescription: An authorization issue was addressed with improved validation.\n\nCVE-2026-113961: an anonymous researcher\n\n### Messages\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: A user added to an iMessage group may be able to access messages sent before they joined\n\nDescription: This issue was addressed by removing the vulnerable code.\n\nCVE-2026-113960: an anonymous researcher\n\n### rapportd\n\nAvailable for: Apple Watch Series 9 and later\n\nImpact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113969: Apple\n\n Published Date: November 09, 2026","published_at":"2026-11-09T00:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":111398,"url":"https://support.apple.com/en-us/149724","title":"Apple: About the security content of visionOS 27.2.1 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of visionOS 27.2.1 - Apple Support\n\n# About the security content of visionOS 27.2.1\n\nThis document describes the security content of visionOS 27.2.1.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## visionOS 27.2.1\n\nReleased November 9, 2026\n\n### AirPlay\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113968: Apple\n\n### App Intents\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An app may be able to access sensitive user data\n\nDescription: An authorization issue was addressed with improved state management.\n\nCVE-2026-113963: László Várady\n\n### Bluetooth\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An attacker in Bluetooth range may be able to corrupt process memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-113970: Apple\n\n### brotli\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: Processing maliciously crafted input may lead to memory corruption\n\nDescription: An out-of-bounds write issue was addressed with improved input validation.\n\nCVE-2026-111497\n\n### CoreUtils\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A malicious Bluetooth device may be able to establish a pairing without user interaction\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-113965: Apple\n\n### CoreUtils\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113964: an anonymous researcher\n\n### Messages\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A remote attacker may be able to join an iMessage group chat and receive its messages\n\nDescription: An authorization issue was addressed with improved validation.\n\nCVE-2026-113961: an anonymous researcher\n\n### Messages\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: A user added to an iMessage group may be able to access messages sent before they joined\n\nDescription: This issue was addressed by removing the vulnerable code.\n\nCVE-2026-113960: an anonymous researcher\n\n### rapportd\n\nAvailable for: Apple Vision Pro (all models)\n\nImpact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113969: Apple\n\n Published Date: November 09, 2026","published_at":"2026-11-09T00:00:00+00:00","relation":"advisory","confidence":null,"note":"Apple disclosure page"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}