Bluetooth, AirPlay Pairing Vulnerabilities Patched Across Apple Platforms

Apple has shipped a round of security fixes across iOS, iPadOS, macOS, watchOS and visionOS, addressing 10 vulnerabilities, five of which involve how devices pair over Bluetooth and AirPlay. The patches cover iOS/iPadOS 27.2.1, 26.7.3 and 18.7.12, macOS Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3, watchOS 27.2.1 and 26.6.1, and visionOS 27.2.1.

Three of the pairing-related issues — CVE-2026-113968 (AirPlay), CVE-2026-113969 (rapportd) and CVE-2026-113964 (CoreUtils) — let an attacker within Bluetooth range or on the same network defeat the limit on pairing-code guesses, with CVE-2026-113964 also enabling pairing without any user interaction. A related CoreUtils bug, CVE-2026-113965, lets a rogue Bluetooth device pair silently as well, while CVE-2026-113970 is a Bluetooth use-after-free that can corrupt process memory.

Apple also closed two Messages bugs — CVE-2026-113961, which could let a remote attacker slip into an iMessage group chat and read its messages, and CVE-2026-113960, which could leak a group's earlier messages to someone added later — along with the previously disclosed Brotli "Node2Shell" flaw CVE-2026-111497, already exploited elsewhere but not reportedly against Apple devices. Two more fixes are platform-specific: an App Intents issue (CVE-2026-113963) on newer OS versions, and CVE-2026-113971, which let someone with physical access pair an AirPlay receiver from the lock screen on older iPhone and iPad models. Apple says none of these flaws have been exploited in the wild.