{"id":"CVE-2026-113971","kind":"vulnerability","aliases":["CVE-2026-113971"],"related":[],"title":"This issue was addressed by restricting options offered on a locked device","description":"About the security content of iOS 18.7.12 and iPadOS 18.7.12 - Apple Support\n\n# About the security content of iOS 18.7.12 and iPadOS 18.7.12\n\nThis document describes the security content of iOS 18.7.12 and iPadOS 18.7.12.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 18.7.12 and iPadOS 18.7.12\n\nReleased November 9, 2026\n\n### AirPlay\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113968: Apple\n\n### Bluetooth\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: An attacker in Bluetooth range may be able to corrupt process memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-113970: Apple\n\n### CoreUtils\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: A malicious Bluetooth device may be able to establish a pairing without user interaction\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-113965: Apple\n\n### CoreUtils\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113964: an anonymous researcher\n\n### MediaRemote\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen\n\nDescription: This issue was addressed by restricting options offered on a locked device.\n\nCVE-2026-113971: Apple\n\n### rapportd\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113969: Apple\n\n Published Date: November 09, 2026","summary":"Apple's iOS 18.7.12 and iPadOS 18.7.12 security notes list CVE-2026-113971 in MediaRemote: an attacker with physical access may pair a device with an AirPlay receiver from the lock screen. The fix restricts the options offered on a locked device.","severity":"low","cvss":3.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","ios","ipad","ipados","iphone","vendor","vendor-advisory"],"not_affected_if":["devices-on-recent-ios"],"how_to_check":"- Check the installed version under Settings > General > About on iPhone XS, iPhone XS Max, iPhone XR or iPad 7th generation","fix":"- iOS and iPadOS `18.7.12` (per the advisory's release section)","status":"open","published_at":"2026-11-09T00:00:00+00:00","first_seen_at":"2026-11-10T00:15:16+00:00","triaged_at":"2026-11-10T00:17:29+00:00","updated_at":"2026-11-10T00:28:47+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T00:17:29Z","model":"claude-haiku-5-5","output":{"fix":"- iOS and iPadOS `18.7.12` (per the advisory's release section)","reach":"local","title":"iOS and iPadOS 18.7.12: MediaRemote lets a person with physical access pair from lock screen","impact":"low","summary":"Apple's iOS 18.7.12 and iPadOS 18.7.12 security notes list CVE-2026-113971 in MediaRemote: an attacker with physical access may pair a device with an AirPlay receiver from the lock screen. The fix restricts the options offered on a locked device.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["ios","ipados","iphone","ipad"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker with physical access pairs a device with an AirPlay receiver","analyst_note":"","how_to_check":"- Check the installed version under Settings > General > About on iPhone XS, iPhone XS Max, iPhone XR or iPad 7th generation\n- Unknown whether a non-default setting changes exposure","plain_action":"Update your iPhone or iPad to iOS 18.7.12 or iPadOS 18.7.12 in Settings > General > Software Update.","product_name":"","needs_analyst":false,"not_affected_if":["devices-on-recent-ios"],"who_is_affected":"The advisory lists iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation as affected. The issue needs physical access to a locked device. Sources do not describe other conditions.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000829,"input_tokens":5433,"output_tokens":571,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113964':352C '-113965':299C '-113968':216C '-113969':452C '-113970':259C '-113971':15A,18A,40B,405C '-2026':14A,17A,39B,215C,258C,298C,351C,404C,451C '09':457C '18.7.12':31B,34B,76C,79C,88C,91C,100C,103C,165C,168C '2026':172C,458C '7th':184C,229C,272C,312C,367C,418C '9':171C 'abl':194C,239C,281C,322C,377C,429C 'access':47B,374C 'address':4A,209C,252C,293C,345C,394C,445C 'advisori':27B 'airplay':54B,173C,384C,436C 'anonym':354C 'appl':19B,28B,80C,105C,112C,138C,142C,160C,217C,260C,300C,406C,453C 'attack':44B,188C,233C,316C,371C,422C 'attempt':203C,331C,439C 'avail':131C,174C,219C,262C,302C,357C,408C 'bluetooth':190C,218C,235C,277C,318C 'bypass':196C,324C,431C 'check':296C 'code':202C,330C,438C 'confirm':118C 'content':73C,85C,97C 'coreutil':261C,301C 'corrupt':241C 'custom':110C 'cve':13A,16A,38B,149C,214C,257C,297C,350C,403C,450C 'cve-id':148C 'date':455C 'describ':94C 'descript':204C,244C,289C,340C,390C,440C 'devic':12A,51B,69B,278C,336C,381C,402C 'disclos':115C 'discuss':116C 'document':93C,144C 'doesn':113C 'establish':283C 'fix':61B 'free':249C 'generat':185C,230C,273C,313C,368C,419C 'id':150C 'impact':186C,231C,274C,314C,369C,420C 'improv':211C,254C,295C,347C,447C 'inform':155C 'interact':288C,339C 'investig':123C 'io':20B,30B,75C,87C,99C,164C 'ipad':21B,183C,228C,271C,311C,366C,417C 'ipado':22B,33B,78C,90C,102C,167C 'iphon':23B,176C,178C,181C,221C,223C,226C,264C,266C,269C,304C,306C,309C,359C,361C,364C,410C,412C,415C 'issu':2A,120C,207C,250C,291C,343C,392C,443C 'limit':199C,327C,434C 'list':37B,135C 'lock':11A,58B,68B,388C,401C 'logic':206C,342C,442C 'malici':276C 'manag':213C,256C,349C,449C 'max':180C,225C,268C,308C,363C,414C 'may':48B,192C,237C,279C,320C,375C,427C 'mediaremot':42B,356C 'memori':243C,255C 'network':426C 'note':36B 'novemb':170C,456C 'occur':125C 'offer':8A,65B,398C 'option':7A,64B,397C 'page':141C,163C 'pair':49B,201C,285C,329C,333C,379C,437C 'patch':127C 'physic':46B,373C 'possibl':152C 'process':242C 'product':161C 'protect':111C 'publish':454C 'rang':191C,236C,319C 'rapportd':407C 'rate':198C,326C,433C 'receiv':55B,385C 'recent':132C 'refer':145C 'releas':129C,133C,140C,169C 'research':355C 'restrict':6A,62B,396C 'screen':59B,389C 'secur':35B,72C,84C,96C,106C,119C,139C,143C,157C,162C 'see':158C 'state':212C,348C,448C 'support':81C 'updat':107C 'use':247C 'use-after-fre':246C 'user':287C,338C 'vendor':24B,26B 'vendor-advisori':25B 'vulner':146C 'without':286C,337C 'xr':182C,227C,270C,310C,365C,416C 'xs':177C,179C,222C,224C,265C,267C,305C,307C,360C,362C,411C,413C","nicknames":[],"mitigations":[],"who_affected":"The advisory lists iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation as affected. The issue needs physical access to a locked device. Sources do not describe other conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update your iPhone or iPad to iOS 18.7.12 or iPadOS 18.7.12 in Settings > General > Software Update.","pkeys":[],"ptokens":[],"labels":["apple","ios","ipad","ipados","iphone","low","vendor","vendoradvisory"],"campaign_type":null,"search_a":"'-113971':15A,18A '-2026':14A,17A 'address':4A 'cve':13A,16A 'devic':12A 'issu':2A 'lock':11A 'offer':8A 'option':7A 'restrict':6A","search_b":"'-113971':40B '-2026':39B '18.7.12':31B,34B 'access':47B 'advisori':27B 'airplay':54B 'appl':19B,28B 'attack':44B 'cve':38B 'devic':51B,69B 'fix':61B 'io':20B,30B 'ipad':21B 'ipado':22B,33B 'iphon':23B 'list':37B 'lock':58B,68B 'may':48B 'mediaremot':42B 'note':36B 'offer':65B 'option':64B 'pair':49B 'physic':46B 'receiv':55B 'restrict':62B 'screen':59B 'secur':35B 'vendor':24B,26B 'vendor-advisori':25B","search_c":"'-113964':352C '-113965':299C '-113968':216C '-113969':452C '-113970':259C '-113971':405C '-2026':215C,258C,298C,351C,404C,451C '09':457C '18.7.12':76C,79C,88C,91C,100C,103C,165C,168C '2026':172C,458C '7th':184C,229C,272C,312C,367C,418C '9':171C 'abl':194C,239C,281C,322C,377C,429C 'access':374C 'address':209C,252C,293C,345C,394C,445C 'airplay':173C,384C,436C 'anonym':354C 'appl':80C,105C,112C,138C,142C,160C,217C,260C,300C,406C,453C 'attack':188C,233C,316C,371C,422C 'attempt':203C,331C,439C 'avail':131C,174C,219C,262C,302C,357C,408C 'bluetooth':190C,218C,235C,277C,318C 'bypass':196C,324C,431C 'check':296C 'code':202C,330C,438C 'confirm':118C 'content':73C,85C,97C 'coreutil':261C,301C 'corrupt':241C 'custom':110C 'cve':149C,214C,257C,297C,350C,403C,450C 'cve-id':148C 'date':455C 'describ':94C 'descript':204C,244C,289C,340C,390C,440C 'devic':278C,336C,381C,402C 'disclos':115C 'discuss':116C 'document':93C,144C 'doesn':113C 'establish':283C 'free':249C 'generat':185C,230C,273C,313C,368C,419C 'id':150C 'impact':186C,231C,274C,314C,369C,420C 'improv':211C,254C,295C,347C,447C 'inform':155C 'interact':288C,339C 'investig':123C 'io':75C,87C,99C,164C 'ipad':183C,228C,271C,311C,366C,417C 'ipado':78C,90C,102C,167C 'iphon':176C,178C,181C,221C,223C,226C,264C,266C,269C,304C,306C,309C,359C,361C,364C,410C,412C,415C 'issu':120C,207C,250C,291C,343C,392C,443C 'limit':199C,327C,434C 'list':135C 'lock':388C,401C 'logic':206C,342C,442C 'malici':276C 'manag':213C,256C,349C,449C 'max':180C,225C,268C,308C,363C,414C 'may':192C,237C,279C,320C,375C,427C 'mediaremot':356C 'memori':243C,255C 'network':426C 'novemb':170C,456C 'occur':125C 'offer':398C 'option':397C 'page':141C,163C 'pair':201C,285C,329C,333C,379C,437C 'patch':127C 'physic':373C 'possibl':152C 'process':242C 'product':161C 'protect':111C 'publish':454C 'rang':191C,236C,319C 'rapportd':407C 'rate':198C,326C,433C 'receiv':385C 'recent':132C 'refer':145C 'releas':129C,133C,140C,169C 'research':355C 'restrict':396C 'screen':389C 'secur':72C,84C,96C,106C,119C,139C,143C,157C,162C 'see':158C 'state':212C,348C,448C 'support':81C 'updat':107C 'use':247C 'use-after-fre':246C 'user':287C,338C 'vulner':146C 'without':286C,337C 'xr':182C,227C,270C,310C,365C,416C 'xs':177C,179C,222C,224C,265C,267C,305C,307C,360C,362C,411C,413C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"lab","external_id":"https://support.apple.com/en-us/149717#CVE-2026-113971","url":"https://support.apple.com/en-us/149717","severity":null,"published_at":"2026-11-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-10T00:15:16+00:00","fetched_at":"2026-11-10T00:15:16+00:00","note":"Apple: About the security content of iOS 18.7.12 and iPadOS 18.7.12 - Apple Support"},{"source":"nvd","external_id":"CVE-2026-113971","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113971","severity":null,"published_at":"2026-11-09T22:18:27+00:00","modified_at":"2026-11-09T22:18:27+00:00","first_seen_at":"2026-11-10T00:28:47+00:00","fetched_at":"2026-11-10T00:28:47+00:00","note":null}],"documents":[{"id":111379,"url":"https://support.apple.com/en-us/149717","title":"Apple: About the security content of iOS 18.7.12 and iPadOS 18.7.12 - Apple Support","kind":"advisory","source":"lab","publisher":"vendor","text":"About the security content of iOS 18.7.12 and iPadOS 18.7.12 - Apple Support\n\n# About the security content of iOS 18.7.12 and iPadOS 18.7.12\n\nThis document describes the security content of iOS 18.7.12 and iPadOS 18.7.12.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.\n\nApple security documents reference vulnerabilities by CVE-ID when possible.\n\nFor more information about security, see the Apple Product Security page.\n\n## iOS 18.7.12 and iPadOS 18.7.12\n\nReleased November 9, 2026\n\n### AirPlay\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113968: Apple\n\n### Bluetooth\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: An attacker in Bluetooth range may be able to corrupt process memory\n\nDescription: A use-after-free issue was addressed with improved memory management.\n\nCVE-2026-113970: Apple\n\n### CoreUtils\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: A malicious Bluetooth device may be able to establish a pairing without user interaction\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2026-113965: Apple\n\n### CoreUtils\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113964: an anonymous researcher\n\n### MediaRemote\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen\n\nDescription: This issue was addressed by restricting options offered on a locked device.\n\nCVE-2026-113971: Apple\n\n### rapportd\n\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\n\nImpact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2026-113969: Apple\n\n Published Date: November 09, 2026","published_at":"2026-11-09T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}