EN PT-BR
← Voltar ao feed
high energy defense

Apple patches iMessage group-chat, Bluetooth pairing and AirPlay flaws in iOS/iPadOS 27.2.1 and matching macOS, watchOS and visionOS updates

5 fonte(s) · 5 atualização(ões) · publicado 09/11/2026 21:00 · coletado há 10 horas

Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 11/11/2026 00:05; os links antigos trazem para cá.

Fontes: zdnet.com ↗ cert.cyber.gouv.fr ↗ thehackernews.com ↗ gbhackers.com ↗ securityonline.info ↗

On 9 November 2026 Apple released iOS 27.2.1 and iPadOS 27.2.1, plus matching updates for macOS, visionOS and watchOS. They fix flaws in Messages, CoreUtils, Bluetooth, AirPlay, rapportd, App Intents and brotli (support.apple.com, gbhackers.com). The most serious is CVE-2026-113961, which lets a remote attacker join an iMessage group chat and receive its messages. CVE-2026-113965 lets a malicious Bluetooth device pair without user interaction. Apple publishes no CVSS score and has not said that any of these flaws was exploited in the wild (gbhackers.com, securityonline.info). CERT-FR advisory CERTFR-2026-AVI-1487 covers ten CVEs, from CVE-2026-111497 to CVE-2026-113971, across Apple's platforms. It warns of confidentiality loss, integrity loss and security policy bypass (cert.cyber.gouv.fr). As of 10 November, updates for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple Watch models did not list the two iMessage fixes (thehackernews.com).

Entenda a falha

A vulnerabilidade

Apple's iOS/iPadOS 27.2.1 update and matching macOS, watchOS and visionOS releases fix ten CVEs. The most serious is CVE-2026-113961, an authorization flaw in Messages that lets a remote attacker join an iMessage group chat and receive its messages. CVE-2026-113965 (CoreUtils) lets a malicious Bluetooth device pair without user interaction. CVE-2026-113964, CVE-2026-113968 (AirPlay, from Bluetooth range) and CVE-2026-113969 (rapportd, from the same network) bypass pairing-code attempt limits. CVE-2026-113970 is a Bluetooth use-after-free in range. CVE-2026-113960 lets a newly added member read earlier group messages. CVE-2026-113963 (App Intents) and CVE-2026-111497 (brotli out-of-bounds write) are also fixed, and CVE-2026-113971 has no detail in the articles. Fixed in iOS/iPadOS 27.2.1, 26.7.3 and 18.7.12, macOS Sequoia 15.8.3, Tahoe 26.7.3, Golden Gate 27.2.1, visionOS 27.2.1 and watchOS 26.6.1/27.2.1. Apple gives no CVSS score and does not say any of these were exploited.

Como funciona

In the iMessage case, a request to join a group chat reaches the Messages component, which should confirm the sender is allowed in. It fails that check, so an outsider is accepted as a member and receives the group's messages. A related flaw let someone legitimately added to a group see messages sent before they joined. In the pairing cases, a nearby device or a device on the same network starts pairing with CoreUtils, AirPlay or rapportd. The pairing code can only be tried a limited number of times, but the logic that enforces the limit breaks, so the attacker can keep guessing the code. In CVE-2026-113965 a malicious device completes pairing without the user doing anything. In the Bluetooth use-after-free, a nearby device triggers memory use after release.

Por que é vulnerável

The articles describe the causes only in Apple's brief wording. CVE-2026-113961 is an authorization issue fixed with improved validation. CVE-2026-113960 was fixed by removing the vulnerable code. CVE-2026-113965 was fixed with improved checks. The pairing-code limit bypasses (CVE-2026-113964, 113968, 113969) are logic issues fixed with improved state management. CVE-2026-113970 is a use-after-free fixed with improved memory management. CVE-2026-111497 lacked input validation, which Apple added. The articles do not say why these went unnoticed.

Onde está

The articles name only components: Messages, CoreUtils, AirPlay, rapportd, Bluetooth, App Intents and the brotli library. They give no files, functions or commits. Details are in Apple bulletins 149715 to 149724, except 149721.

Como foi descoberta

Apple published the fixes on 9 November 2026 in its security bulletins, and CERT-FR issued advisory CERTFR-2026-AVI-1487 the next day. ZDNet reports that about half of the flaws were found internally by Apple and the rest were submitted by researchers. gbhackers credits an anonymous researcher for CVE-2026-113961, 113960 and 113964, and László Várady for CVE-2026-113963. Apple is credited for CVE-2026-113965, 113968, 113969 and 113970, and no one for the brotli flaw. The Hacker News says CISA added the Google Brotli decoder flaw to its Known Exploited Vulnerabilities catalog on 27 October, though Apple's notes mention no attacks. ZDNet gives the release as Tuesday, while the Apple advisory is dated 9 November.

Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 00:21.

Detalhes técnicos

  • CVE-2026-113961 (Messages): an authorization flaw let a remote attacker join an iMessage group and receive its messages. Fixed with improved validation. Reported by an anonymous researcher (support.apple.com via securityonline.info, gbhackers.com).
  • CVE-2026-113960 (Messages): a user added to a group could read messages sent before joining. Fixed by removing the vulnerable code. Reported by an anonymous researcher (gbhackers.com).
  • CVE-2026-113965 (CoreUtils): a malicious Bluetooth device could complete pairing without user interaction. Fixed with improved checks. Credited to Apple (gbhackers.com).
  • CVE-2026-113964 (CoreUtils): a logic issue let an attacker in Bluetooth range bypass the pairing-code attempt limit and pair without user interaction. Reported by an anonymous researcher (gbhackers.com).
  • CVE-2026-113968 (AirPlay): an attacker in Bluetooth range could bypass the AirPlay pairing-code attempt limit. Credited to Apple (gbhackers.com).
  • CVE-2026-113969 (rapportd): an attacker on the same network could bypass the AirPlay pairing-code attempt limit. Credited to Apple (gbhackers.com).
  • CVE-2026-113970 (Bluetooth): a use-after-free let an attacker in Bluetooth range corrupt process memory. Fixed with improved memory management. Credited to Apple (gbhackers.com).
  • CVE-2026-113963 (App Intents), reported by László Várady, and CVE-2026-111497 (brotli) are also listed in the iOS 27.2.1 fixes (gbhackers.com).
  • Beyond the iOS fixes, an AppleVis report says 27.2.1 includes a fix for macOS command line tools involving compromised eMudhra certificates. It does not map this to a CVE in the CERT-FR list (applevis.com).
  • Affected branches per CERT-FR: iOS and iPadOS before 18.7.12, 26.7.3 and 27.2.1; macOS Golden Gate before 27.2.1; macOS Sequoia before 15.8.3; macOS Tahoe before 26.7.3; visionOS before 27.2.1; watchOS before 26.6.1 and 27.2.1. CERT-FR gives no per-CVE severity, attack vector or affected component. It refers readers to Apple bulletins 149715 to 149724, except 149721 (cert.cyber.gouv.fr).
  • Around half of the flaws were found internally by Apple and the rest were submitted by researchers (zdnet.com).

Remediação

  • Update iPhones and iPads to iOS 27.2.1 or iPadOS 27.2.1 via Settings > General > Software Update (macrumors.com via securityonline.info). Devices that do not run iOS 27 can take iOS 26.7.3 or iOS 18.7.12. Apple lists the iPhone 11 and later, plus compatible iPads, as covered (securityonline.info).
  • Other platforms, per CERT-FR: macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, and macOS Golden Gate, visionOS and watchOS 27.2.1. The watchOS 26 branch needs 26.6.1 (cert.cyber.gouv.fr).
  • Owners of the older iPhone XS, XS Max, XR, the iPad (7th generation) and some Apple Watch models should check Apple's bulletins. Their updates did not list the iMessage fixes as of 10 November (thehackernews.com).

Relatos divergentes

  • Scope: CERT-FR counts ten CVEs across all Apple platforms (cert.cyber.gouv.fr). gbhackers.com counts nine fixed in iOS 27.2.1, while securityonline.info lists only seven. gbhackers.com, the more recent of the two, adds CVE-2026-113963 and CVE-2026-111497.
  • CVE-2026-113965: securityonline.info's summary says it requires physical proximity. gbhackers.com, citing Apple's advisory, describes it as a malicious Bluetooth device pairing without user interaction, and the later source is the more reliable one.
  • Unconfirmed claims: securityonline.info says Apple's advisory does not confirm an article's DarkSword link or a local privilege escalation, and neither is established.
  • Release date: most sources and the Apple advisory give 9 November 2026. zdnet.com says Apple released the patches on Tuesday (10 November), and the dated advisory takes precedence.

Linha do tempo

  1. zdnet.com ↗ · pub. 10/11/2026 13:54 · coletado 10/11 15:00

    All your Apple devices need to be patched ASAP - here's why - ZDNET

    ler a análise desta fonte

    On Tuesday, Apple released security patches for iOS, iPadOS, MacOS, WatchOS, and VisionOS, which address wireless security flaws in Bluetooth pairing, AirPlay, and Messages.

    According to Apple’s security notes, vulnerabilities can allow attackers to establish a Bluetooth connection without user interaction, bypass AirPlay connection rate limits, and join an iMessage group chat and receive its messages. Around half of these flaws were found internally by Apple, while the others were submitted by researchers.

  2. cert.cyber.gouv.fr ↗ · pub. 09/11/2026 21:00 · coletado 10/11 13:04

    Apple iOS, iPadOS, macOS, visionOS and watchOS: ten CVEs fixed in November 2026 updates

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1487 covers multiple vulnerabilities in Apple operating systems, with bulletins dated 9 November 2026 (Apple security bulletins 149715 to 149724, except 149721). The advisory lists ten CVEs, from CVE-2026-111497 to CVE-2026-113971, and says they can lead to data confidentiality loss, data integrity loss or a security policy bypass. The article does not give a per-CVE severity, a CVSS score, the affected components or any exploitation status, and it refers readers to Apple's bulletins for the details. The Apple bulletin pages could not be opened during this research, so the vendor's own severity and prerequisites are not confirmed here. A separate AppleVis report on the 27.2.1 release says it includes security fixes for iOS, iPadOS, macOS and watchOS, one of them concerning macOS command line tools and compromised eMudhra certificates (applevis.com), but that report does not map to the CVE list in the advisory. Urgency is rated medium because the vendor-patched flaws have no stated exploitation or severity, yet they span every major Apple platform and should be patched promptly.

    Technical Details

    The advisory names three impact categories: data integrity, data confidentiality and security policy bypass. It lists affected branches: iOS and iPadOS before 18.7.12, 26.7.3 and 27.2.1; macOS Golden Gate before 27.2.1, macOS Sequoia before 15.8.3 and macOS Tahoe before 26.7.3; visionOS before 27.2.1; and watchOS before 26.6.1 and 27.2.1. The article does not state the attack vector, prerequisites or user interaction for any CVE.

    Remediation

    Apply the Apple updates for each platform and branch listed above, using the fixed versions the advisory gives: iOS and iPadOS 18.7.12, 26.7.3 or 27.2.1; macOS Sequoia 15.8.3; macOS Tahoe 26.7.3; macOS Golden Gate, visionOS and watchOS 27.2.1; watchOS 26.6.1 for the 26 branch. The advisory directs administrators to Apple's bulletins for the patches (cert.cyber.gouv.fr).

  3. thehackernews.com ↗ · pub. 10/11/2026 07:16 · coletado 10/11 08:00

    Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities

    ler a análise desta fonte

    An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined.

    As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple Watch models do not list either fix.

  4. gbhackers.com ↗ · pub. 10/11/2026 06:05 · coletado 10/11 07:00

    Apple fixes nine iOS 27.2.1 flaws in iMessage, Bluetooth, AirPlay and brotli

    Compared with the existing case, this article adds two flaws the case did not list: CVE-2026-113963 in App Intents, reported by László Várady, and CVE-2026-111497 in brotli. Apple's advisory also corrects several points of the case: CVE-2026-113965 is described as a malicious Bluetooth device pairing without user interaction, not as a flaw requiring physical contact; CVE-2026-113969 requires the same network; and Apple is credited as the finder of four entries. The iOS 26.7.3 and iOS 18.7.12 fix lists are now credited to digitbin.com.

    ler a análise desta fonte

    Compared with the existing case, this article adds two flaws the case did not list: CVE-2026-113963 in App Intents, reported by László Várady, and CVE-2026-111497 in brotli. Apple's advisory also corrects several points of the case: CVE-2026-113965 is described as a malicious Bluetooth device pairing without user interaction, not as a flaw requiring physical contact; CVE-2026-113969 requires the same network; and Apple is credited as the finder of four entries. The iOS 26.7.3 and iOS 18.7.12 fix lists are now credited to digitbin.com.

    Apple released iOS 27.2.1 and iPadOS 27.2.1 on November 9, 2026, fixing nine CVEs in Messages, CoreUtils, Bluetooth, AirPlay, rapportd, App Intents and brotli (support.apple.com). The most serious entry is CVE-2026-113961, which lets a remote attacker join an iMessage group chat and receive its messages. CVE-2026-113965 lets a malicious Bluetooth device pair without user interaction. Three pairing-code rate-limit bypasses (CVE-2026-113964, CVE-2026-113968 and CVE-2026-113969) make guessing codes easier, but they need a nearby attacker or, for the last one, an attacker on the same network. Apple publishes no CVSS score in its advisory and did not state that any of these flaws was exploited in the wild (macrumors.com). Criticity is high rather than critical because no exploitation is reported and no entry describes code execution.

    Technical Details

    • CVE-2026-113961 (Messages): an authorization issue let a remote attacker join an iMessage group chat and receive its messages. Fixed with improved validation. Reported by an anonymous researcher (support.apple.com).
    • CVE-2026-113960 (Messages): a user added to an iMessage group could read messages sent before joining. Fixed by removing the vulnerable code. Reported by an anonymous researcher (support.apple.com).
    • CVE-2026-113965 (CoreUtils): a malicious Bluetooth device could complete a pairing without user interaction. Fixed with improved checks. Credited to Apple (support.apple.com).
    • CVE-2026-113964 (CoreUtils): a logic issue let an attacker in Bluetooth range bypass the pairing-code attempt limit and pair without user interaction. Fixed with improved state management. Reported by an anonymous researcher (support.apple.com).
    • CVE-2026-113968 (AirPlay): a logic issue let an attacker in Bluetooth range bypass the AirPlay pairing-code attempt limit. Fixed with improved state management. Credited to Apple (support.apple.com).
    • CVE-2026-113969 (rapportd): a logic issue let an attacker on the same network bypass the AirPlay pairing-code attempt limit. Fixed with improved state management. Credited to Apple (support.apple.com).
    • CVE-2026-113970 (Bluetooth): a use-after-free let an attacker in Bluetooth range corrupt process memory. Fixed with improved memory management. Credited to Apple (support.apple.com).
    • CVE-2026-113963 (App Intents): an authorization issue let an app access sensitive user data. Fixed with improved state management. Reported by László Várady (support.apple.com).
    • CVE-2026-111497 (brotli): an out-of-bounds write triggered by maliciously crafted input caused memory corruption. Fixed with improved input validation. No researcher is credited (support.apple.com).

    The advisory names the Bluetooth component but no daemon, and no entry describes privilege escalation (support.apple.com). Third-party listings derived from NVD data show CVSS 8.8 for CVE-2026-113970, 7.5 for CVE-2026-113961 and 5.5 for CVE-2026-113963 (app.opencve.io). These scores were not checked on NVD itself and are not Apple's own rating.

    Remediation

    • Update iPhone and iPad to iOS 27.2.1 or iPadOS 27.2.1 through Settings > General > Software Update (digitbin.com).
    • Devices that cannot run iOS 27 can install iOS 26.7.3 / iPadOS 26.7.3 (iPhone 11 and later) or iOS 18.7.12 / iPadOS 18.7.12 (iPhone XS, XS Max, XR and iPad 7th generation) (digitbin.com).
    • The per-CVE listings show CVE-2026-113961 and CVE-2026-113970 also fixed in the 26.7.3 branch, and CVE-2026-113970 in the 18.7.12 branch (app.opencve.io, vulners.com).
    • Apple's advisory lists the supported hardware for 27.2.1 as iPhone 11 and later and the listed iPad models (support.apple.com).
    • No public commit or pull request for these fixes was found in the research. The Apple advisory is the only fix reference, so this report has no Fix Details section.
  5. securityonline.info ↗ · pub. 09/11/2026 23:48 · coletado 10/11 00:00 primeiro registro

    Apple corrige falhas no iMessage e pareamento Bluetooth/AirPlay no iOS 27.2.1

    ler a análise desta fonte

    Apple publicou o iOS 27.2.1 e o iPadOS 27.2.1 em 9 de novembro de 2026, com correções de segurança para iMessage, Bluetooth, AirPlay e rapportd (support.apple.com). O problema mais grave é o CVE-2026-113961, que permite a um atacante remoto entrar em um grupo do iMessage e receber suas mensagens. O CVE-2026-113965 permite que um dispositivo Bluetooth malicioso pareie sem interação do usuário, mas exige proximidade física. As demais falhas dependem de alcance Bluetooth, da mesma rede ou de já estar em um grupo, o que limita o risco imediato. A Apple não atribui pontuação CVSS nesse aviso e não afirma que alguma delas tenha sido explorada. O aviso também não confirma a alegação do artigo sobre DarkSword nem a elevação de privilégio local.

    Technical Details

    • CVE-2026-113961 (Messages): falha de autorização corrigida com validação aprimorada. Um atacante remoto podia entrar em grupo do iMessage e receber as mensagens. Reportada por pesquisador anônimo (support.apple.com).
    • CVE-2026-113960 (Messages): usuário adicionado a um grupo podia ler mensagens enviadas antes da entrada. A correção remove o código vulnerável. Reportada por pesquisador anônimo (support.apple.com).
    • CVE-2026-113965 (CoreUtils): dispositivo Bluetooth malicioso podia estabelecer pareamento sem interação do usuário. Corrigido com verificações aprimoradas (support.apple.com).
    • CVE-2026-113964 (CoreUtils): atacante no alcance Bluetooth contornava o limite de tentativas do código de pareamento e parava de depender do usuário para parear. Reportada por pesquisador anônimo (support.apple.com).
    • CVE-2026-113968 (AirPlay): atacante no alcance Bluetooth contornava o limite de tentativas do código de pareamento do AirPlay (support.apple.com).
    • CVE-2026-113969 (rapportd): atacante na mesma rede contornava o limite de tentativas do código de pareamento do AirPlay (support.apple.com).
    • CVE-2026-113970 (Bluetooth): use-after-free que podia corromper a memória do processo a partir do alcance Bluetooth. Corrigido com gerenciamento de memória aprimorado (support.apple.com).

    A Apple não nomeia o daemon Bluetooth afetado nem descreve elevação de privilégio. O artigo atribui essas informações ao aviso, o que não se confirma.

    Remediation

    • Atualize o iPhone e o iPad para iOS 27.2.1 e iPadOS 27.2.1, em Ajustes > Geral > Atualização de Software (macrumors.com).
    • Dispositivos que não rodam iOS 27 podem receber iOS 26.7.3 ou iOS 18.7.12 (macrumors.com).
    • A Apple lista o iPhone 11 e modelos posteriores, além dos iPads compatíveis, como plataformas cobertas pela correção (support.apple.com).
    • Não encontrei commit ou pull request público para estas correções. O aviso da Apple é a única referência de correção, por isso não há seção de detalhes da correção.

    Relatos divergentes

    • O artigo fala em limites de senha (passcode) para CVE-2026-113964, CVE-2026-113968 e CVE-2026-113969. O aviso da Apple se refere a limites de tentativas do código de pareamento (support.apple.com). A Apple é a fonte oficial e prevalece.
    • O artigo diz que o CVE-2026-113969 exige alcance sem fio. A Apple indica que ele exige estar na mesma rede (support.apple.com).
    • O artigo afirma que os atacantes podem elevar privilégios localmente. O aviso da Apple não menciona elevação de privilégio (support.apple.com).