--- id: "CVE-2026-113970" page: "https://infrastack.ai/live/CVE-2026-113970" kind: "vulnerability" aliases: ["CVE-2026-113970"] title: "A use-after-free issue was addressed with improved memory management" severity: "high" cvss: 8.8 epss: null exploited: false status: "open" category: "infrastructure" products: [] ecosystems: [] tags: ["apple", "bluetooth", "infrastructure", "ios", "ipad", "ipados", "iphone", "vendor-advisory"] not_affected_if: ["already-on-27.2.1-or-later"] published_at: "2026-11-09T00:00:00+00:00" first_seen_at: "2026-11-10T00:15:16+00:00" updated_at: "2026-11-10T00:41:44+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/149715", "first_seen_at": "2026-11-10T00:15:16+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149716", "first_seen_at": "2026-11-10T00:15:16+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149717", "first_seen_at": "2026-11-10T00:15:16+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149718", "first_seen_at": "2026-11-10T00:15:16+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149719", "first_seen_at": "2026-11-10T00:15:16+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149720", "first_seen_at": "2026-11-10T00:15:16+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149722", "first_seen_at": "2026-11-10T00:15:16+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149723", "first_seen_at": "2026-11-10T00:15:16+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149724", "first_seen_at": "2026-11-10T00:16:53+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113970", "first_seen_at": "2026-11-10T00:28:47+00:00"}] exploit_sources: [] --- # A use-after-free issue was addressed with improved memory management Link for people: https://infrastack.ai/live/CVE-2026-113970 (this .md is for agents) Apple's iOS 27.2.1 and iPadOS 27.2.1 update fixes a use-after-free bug in the Bluetooth component. An attacker within Bluetooth range can corrupt process memory on the device. _Summary, check and fix written by a model from the sources; labelled as such._ ## How to check - Check that the iPhone or iPad runs iOS or iPadOS below `27.2.1`. - Check the device model against the list of supported devices in Apple's advisory (iPhone 11 and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, iPad mini 6th generation and later). ## Fix - iOS: `27.2.1` - iPadOS: `27.2.1` ## Timeline - 2026-11-10T00:15:16+00:00 lab https://support.apple.com/en-us/149715 — Apple: About the security content of iOS 27.2.1 and iPadOS 27.2.1 - Apple Support - 2026-11-10T00:15:16+00:00 lab https://support.apple.com/en-us/149716 — Apple: About the security content of iOS 26.7.3 and iPadOS 26.7.3 - Apple Support - 2026-11-10T00:15:16+00:00 lab https://support.apple.com/en-us/149717 — Apple: About the security content of iOS 18.7.12 and iPadOS 18.7.12 - Apple Support - 2026-11-10T00:15:16+00:00 lab https://support.apple.com/en-us/149718 — Apple: About the security content of macOS Golden Gate 27.2.1 - Apple Support - 2026-11-10T00:15:16+00:00 lab https://support.apple.com/en-us/149719 — Apple: About the security content of macOS Tahoe 26.7.3 - Apple Support - 2026-11-10T00:15:16+00:00 lab https://support.apple.com/en-us/149720 — Apple: About the security content of macOS Sequoia 15.8.3 - Apple Support - 2026-11-10T00:15:16+00:00 lab https://support.apple.com/en-us/149722 — Apple: About the security content of watchOS 27.2.1 - Apple Support - 2026-11-10T00:15:16+00:00 lab https://support.apple.com/en-us/149723 — Apple: About the security content of watchOS 26.6.1 - Apple Support - 2026-11-10T00:16:53+00:00 lab https://support.apple.com/en-us/149724 — Apple: About the security content of visionOS 27.2.1 - Apple Support - 2026-11-10T00:28:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113970 ## Documents - [advisory] Apple: About the security content of watchOS 26.6.1 - Apple Support https://support.apple.com/en-us/149723 - [advisory] Apple: About the security content of iOS 27.2.1 and iPadOS 27.2.1 - Apple Support https://support.apple.com/en-us/149715 - [advisory] Apple: About the security content of iOS 26.7.3 and iPadOS 26.7.3 - Apple Support https://support.apple.com/en-us/149716 - [advisory] Apple: About the security content of iOS 18.7.12 and iPadOS 18.7.12 - Apple Support https://support.apple.com/en-us/149717 - [advisory] Apple: About the security content of macOS Golden Gate 27.2.1 - Apple Support https://support.apple.com/en-us/149718 - [advisory] Apple: About the security content of macOS Tahoe 26.7.3 - Apple Support https://support.apple.com/en-us/149719 - [advisory] Apple: About the security content of macOS Sequoia 15.8.3 - Apple Support https://support.apple.com/en-us/149720 - [advisory] Apple: About the security content of watchOS 27.2.1 - Apple Support https://support.apple.com/en-us/149722 - [advisory] Apple: About the security content of visionOS 27.2.1 - Apple Support https://support.apple.com/en-us/149724 ## From the sources About the security content of iOS 27.2.1 and iPadOS 27.2.1 - Apple Support # About the security content of iOS 27.2.1 and iPadOS 27.2.1 This document describes the security content of iOS 27.2.1 and iPadOS 27.2.1. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## iOS 27.2.1 and iPadOS 27.2.1 Released November 9, 2026 ### AirPlay Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts Description: A logic issue was addressed with improved state management. CVE-2026-113968: Apple ### App Intents Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-113963: László Várady ### Bluetooth Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An attacker in Bluetooth range may be able to corrupt process memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-113970: Apple ### brotli Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: Processing maliciously crafted input may lead to memory corruption Description: An out-of-bounds write issue was addressed with improved input validation. ### CoreUtils Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: A malicious Bluetooth device may be able to establish a pairing without user interaction Description: This issue was addressed with improved checks. CVE-2026-113965: Apple ### CoreUtils Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction Description: A logic issue was addressed with improved state management. CVE-2026-113964: an anonymous researcher ### Messages Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: A remote attacker may be able to join an iMessage group chat and receive its messages Description: An authorization issue was addressed with improved validation. CVE-2026-113961: an anonymous researcher ### Messages Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: A user added to an iMessage group may be able to access messages sent before they joined Description: This issue was addressed by removing the vulnerable code. CVE-2026-113960: an anonymous researcher ### rapportd Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later Impact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts Description: A logic issue was addressed with improved state management. CVE-2026-113969: Apple Published Date: November 09, 2026 --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_