EN PT-BR
← Voltar ao feed
critical technology communication

Apple patches iMessage, Bluetooth and AirPlay pairing flaws in iOS/iPadOS 27.2.1 and matching macOS, watchOS and visionOS updates

6 fonte(s) · 7 atualização(ões) · publicado 09/11/2026 23:48 · coletado há 13 horas

Matéria consolidada. Reúne 5 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 6 fontes trouxeram em 14/11/2026 00:02; os links antigos trazem para cá.

Fontes: cert.cyber.gouv.fr ×2 ↗ securityweek.com ↗ zdnet.com ↗ thehackernews.com ↗ gbhackers.com ↗ securityonline.info ↗

Apple released iOS 27.2.1 and iPadOS 27.2.1, with matching updates for macOS, watchOS and visionOS, on or around 9-10 November 2026. The updates fix roughly nine to ten vulnerabilities, most of them in wireless pairing (Bluetooth, AirPlay) and iMessage (Messages) authorization. The most prominent are CVE-2026-113961 and CVE-2026-113960, which could let a remote attacker join iMessage group chats and read messages or chat history (thehackernews.com, securityonline.info). Other fixes cover silent Bluetooth pairing, brute-force and rate-limit bypasses in Bluetooth and AirPlay pairing, and issues in Google's Brotli compression library. No source reports active exploitation (gbhackers.com, securityweek.com), although Apple did not state exploitation status or exploitation prerequisites (thehackernews.com). The French CERT (cert.cyber.gouv.fr) rates the overall set as critical and notes that some flaws allow remote code execution, unauthorized access and silent device pairing. Fixes were also backported to older iOS, macOS, visionOS and watchOS releases (securityonline.info, zdnet.com). A later CERT-FR advisory dated 13 November 2026 (cert.cyber.gouv.fr) links CVE-2026-111497 and related CVEs to Apple security bulletin 149851 of 12 November 2026, which it describes as covering Apple HomeView Software before version 27.2 and as allowing remote code execution.

Entenda a falha

A vulnerabilidade

Apple fixed about nine to ten flaws in iOS/iPadOS 27.2.1, 26.7.3 and 18.7.12, macOS Golden Gate 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3, watchOS 26.6.1 and 27.2.1, and visionOS 27.2.1. The most severe is CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder that malicious input can use to corrupt memory. It is on CISA's KEV list, though there is no sign of attacks on Apple products. CVE-2026-113970 is a Bluetooth use-after-free reachable from Bluetooth range. CVE-2026-113965 and CVE-2026-113964 (CoreUtils) allow silent Bluetooth pairing. CVE-2026-113961 lets a remote attacker join an iMessage group chat and read its messages, and CVE-2026-113960 exposes earlier chat history to newly added members. CVE-2026-113964, 113968 and 113969 bypass pairing-code rate limits, and CVE-2026-113963 lets an app reach sensitive data through App Intents. CERT-FR lists a separate advisory tying these CVEs to HomeView Software before 27.2, but the articles do not clarify that link.

Como funciona

For the pairing flaws, a nearby device or a device on the same network starts a Bluetooth or AirPlay pairing. Normally the system counts wrong pairing-code guesses and locks out the requester after a few failures. In the rate-limit bugs this state tracking fails, so guesses can continue until one works. In the silent-pairing bugs, the pairing completes without the user confirming anything. For iMessage, a request to join a group is processed by Messages, which should check that the sender is allowed. That check fails, so the party is admitted and receives messages. In the second Messages bug, a newly added member is given earlier history. For Brotli, compressed input reaches the decoder, which writes past the end of a buffer while decoding.

Por que é vulnerável

The causes are mostly missing or faulty checks. Apple describes the group-join bug as an authorization issue fixed with improved validation, and the history exposure was fixed by removing the vulnerable code. The rate-limit bypasses are logic issues fixed with improved state management. Silent pairing was fixed with improved checks, and the Bluetooth use-after-free with better memory management. The Brotli write was fixed by adding input validation. The articles do not explain why these went unnoticed.

Onde está

The articles name affected components, not files or functions: Messages, CoreUtils (CVE-2026-113964 and 113965), the Bluetooth stack, AirPlay, rapportd (CVE-2026-113969), App Intents and the Brotli decoder.

Como foi descoberta

Apple published the fixes on 9 November 2026 (gbhackers, CERT-FR bulletins); some outlets say 10 November. SecurityWeek says Apple credits itself for five of the flaws, and ZDNet says about half were found internally. An anonymous researcher reported both Messages bugs and CVE-2026-113964, and László Várady reported the App Intents flaw CVE-2026-113963. No researcher is credited for the Brotli flaw CVE-2026-111497, which CISA added to KEV on 27 October. Apple does not say any of the flaws are exploited. CERT-FR later issued advisory CERTFR-2026-AVI-1526 on 13 November, citing Apple bulletin 149851 of 12 November.

PoC existente, privada

O exploit existe, mas quem o tem não o publicou.

No article reports a public proof of concept for the Apple flaws. For the Brotli flaw, SecurityWeek says threat actors have exploited it in the wild under the name Node2Shell, and CISA lists it as exploited, but no published exploit copy is mentioned. It is therefore treated as private. Since Brotli is exploited elsewhere, patching it should be prioritized, even though no attacks against Apple products are known.

Explicação gerada por IA a partir da matéria e dos artigos, em 14/11/2026 00:17.

Detalhes técnicos

  • CVE-2026-113961: authorization logic issue in Messages that lets an unauthorized party join a group chat and read its messages (zdnet.com, thehackernews.com, securityonline.info).
  • CVE-2026-113960: could expose chat history when a member is invited (securityonline.info, securityweek.com).
  • CVE-2026-113965: a malicious peripheral can pair or connect over Bluetooth silently, without user interaction (securityonline.info, zdnet.com).
  • CVE-2026-113964, CVE-2026-113968, CVE-2026-113969: brute-force or rate-limit bypasses in Bluetooth and AirPlay authentication (securityonline.info, securityweek.com). zdnet.com describes CVE-2026-113964 as an AirPlay pairing PIN brute-force that could let a nearby attacker take control of a device.
  • CVE-2026-113970: described as a memory corruption issue in Bluetooth pairing (securityweek.com).
  • CVE-2026-111497: listed by zdnet.com among the additional bypass and remote code execution issues. cert.cyber.gouv.fr (13 November) names it as the lead CVE of an advisory on Apple HomeView Software before 27.2, covering remote code execution, data confidentiality and integrity breaches, and security policy bypass, with Apple security bulletin 149851 dated 12 November 2026. No source gives a technical description of the flaw itself.
  • gbhackers.com describes the set as including use-after-free, authorization bypass and memory corruption flaws, affecting iMessage, Bluetooth, AirPlay and the brotli library. Some are exploitable from Bluetooth range or need network proximity (securityweek.com).
  • Apple credits its own team and external researchers (gbhackers.com, securityweek.com, zdnet.com).
  • Apple's fixes improved the Messages validation logic, added stronger pairing verification checks in Bluetooth, and reinforced AirPlay PIN rate limiting (zdnet.com).

Remediação

  • Update to iOS 27.2.1, iPadOS 27.2.1, macOS 27.2.1 (and the earlier supported macOS releases), watchOS 26.6.1 and visionOS 27.2.1 (zdnet.com). Backported fixes cover legacy devices.
  • Update Apple HomeView Software to version 27.2 or later, immediately, per the CERT-FR advisory (cert.cyber.gouv.fr).
  • Review Bluetooth and AirPlay settings and watch for unusual messaging or wireless pairing activity (zdnet.com).
  • Consult Apple's security bulletin for the per-version fixes (cert.cyber.gouv.fr).

Relatos divergentes

  • Number of vulnerabilities: nine (gbhackers.com) versus ten (securityweek.com). securityweek.com is the more recent, but none of the sources lists all of the CVEs, so the exact count is unconfirmed.
  • Release date: 9 November 2026 (gbhackers.com) versus 10 November 2026 (zdnet.com). The other sources were published on 10 November. cert.cyber.gouv.fr (13 November) cites an Apple bulletin dated 12 November 2026, and does not say whether it is the same release.
  • Exploitation status: gbhackers.com and securityweek.com report no known exploitation. thehackernews.com says Apple did not specify, so the absence of exploitation is not confirmed by Apple in the sources.
  • CVE-2026-113964: placed in Bluetooth pairing (securityweek.com), in AirPlay (zdnet.com), and in both (securityonline.info).
  • Product scope: securityonline.info and thehackernews.com focus on iOS and iPadOS, while zdnet.com, securityweek.com and cert.cyber.gouv.fr also cover macOS, watchOS and visionOS.
  • CVE-2026-111497 scope: zdnet.com lists it among the 27.2.1 OS fixes, while cert.cyber.gouv.fr (more recent, 13 November) ties it to Apple HomeView Software before version 27.2 and to bulletin 149851 of 12 November. The sources do not show whether this is the same set of fixes, so the relationship is unconfirmed.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 12/11/2026 21:00 · coletado 13/11 12:01

    Multiple critical vulnerabilities including remote code execution found in Apple HomeView Software before version 27.2

    ler a análise desta fonte

    Multiple serious security vulnerabilities have been discovered in Apple HomeView Software versions prior to 27.2, including remote code execution (RCE), data confidentiality and integrity breaches, and security policy bypass. These flaws allow attackers to execute arbitrary code remotely and compromise data trustworthiness. Apple has released security bulletin 149851 on November 12, 2026, addressing these issues with patches. The affected software should be updated immediately to mitigate the risks associated with CVE-2026-111497 and related CVEs. The vulnerabilities were officially disclosed by the French CERT-FR advisories referencing Apple's security bulletin and CVE database entries.

  2. securityweek.com ↗ · pub. 11/11/2026 04:00 · coletado 11/11 06:00

    Apple patches Bluetooth and AirPlay pairing vulnerabilities across multiple platforms

    ler a análise desta fonte

    Apple has released security updates for iOS, iPadOS, macOS, watchOS, and visionOS addressing ten vulnerabilities, with five related to Bluetooth and AirPlay pairing. Notably, CVE-2026-113964, CVE-2026-113965, and CVE-2026-113970 involve bypasses and memory corruption in Bluetooth pairing, potentially allowing nearby attackers to pair devices or cause memory issues. Three vulnerabilities (CVE-2026-113968, CVE-2026-113969, CVE-2026-113964) concern brute-force or rate-limit bypasses during AirPlay and Bluetooth pairing, with some exploitable from Bluetooth range or requiring network proximity. Additionally, two Message-related flaws (CVE-2026-113961 and CVE-2026-113960) could enable malicious actors to join group chats or access message history in iMessage. Apple credits itself and external researchers for several fixes, with no indications of active exploitation reported in the wild.

  3. zdnet.com ↗ · pub. 10/11/2026 13:54 · coletado 10/11 15:00

    Apple releases urgent security patches for iOS, iPadOS, macOS, WatchOS, and VisionOS addressing wireless vulnerabilities

    ler a análise desta fonte

    On November 10, 2026, Apple released security updates across its entire ecosystem, including iOS, iPadOS, macOS, WatchOS, and VisionOS. These patches address critical wireless security flaws, notably in Bluetooth pairing, AirPlay, and Messages. Notable issues include the ability for attackers to establish Bluetooth connections without user interaction, bypass AirPlay pairing rate limits, and remotely join iMessage group chats to read messages. Several vulnerabilities were internally discovered by Apple, while others were submitted by researchers, highlighting the ongoing focus on wireless security in Apple devices.

    Technical Details

    • A flaw in Messages (CVE-2026-113961) allows unauthorized users to join and read group chat messages due to an authorization logic issue.
    • Bluetooth connection vulnerabilities (CVE-2026-113965) enable malicious actors to connect to devices without interaction, likely involving improved checks in pairing verification.
    • AirPlay-related flaw (CVE-2026-113964) permits brute-force passage of pairing PINs, potentially allowing attackers within range to take control of devices.
    • Additional CVEs (CVE-2026-113960, CVE-2026-113968, CVE-2026-113969, CVE-2026-113970, CVE-2026-111497) cover various bypasses including connection rate limit bypass and remote code execution issues.
    • Many of these flaws were found internally by Apple or reported by researchers.

    Fix Details

    • Apple fixed the Messages authorization issue by improving validation logic.
    • Bluetooth pairing logic was strengthened with better verification checks.
    • The AirPlay PIN rate-limiting mechanism was reinforced to prevent brute-force attacks.
    • Updates were backported to legacy devices including older iOS, macOS, visionOS, and watchOS versions.

    Remediation

    • All users are strongly advised to update their devices to the latest versions: iOS 27.2.1, iPadOS 27.2.1, macOS 27.2.1 (and earlier supported versions), WatchOS 26.6.1, and VisionOS 27.2.1.
    • Apple recommends reviewing device security settings, especially around Bluetooth and AirPlay configurations, and monitoring for unusual activity in messaging and wireless connections.
  4. cert.cyber.gouv.fr ↗ · pub. 09/11/2026 21:00 · coletado 10/11 13:04

    Apple Critical Vulnerabilities Affect Multiple iOS and macOS Versions

    ler a análise desta fonte

    Multiple vulnerabilities have been identified in various Apple products, including iOS, iPadOS, macOS, visionOS, and watchOS. These flaws can lead to data confidentiality breaches, integrity issues, and security policy bypasses. Apple has released security patches detailed in their bulletin to address these issues. The vulnerabilities impact several Apple OS versions, with some allowing remote code execution, unauthorized access, and silent device pairing, among other exploits.

  5. thehackernews.com ↗ · pub. 10/11/2026 07:16 · coletado 10/11 08:00

    Apple releases patches for iMessage privacy flaws and Bluetooth pairing vulnerabilities

    ler a análise desta fonte

    Apple has issued updates addressing multiple security flaws, including critical vulnerabilities in iMessage that could allow a remote attacker to join group chats and access messages, as well as other flaws affecting Bluetooth and AirPlay. The CVE-2026-113961 and CVE-2026-113960 vulnerabilities impact iOS and iPadOS 27.2.1, with fixes applied to various Apple devices. The company did not specify whether these vulnerabilities are actively exploited or the prerequisites for exploitation. Additional updates fix issues in Google's Brotli compression library, which are not currently known to be exploited.

  6. gbhackers.com ↗ · pub. 10/11/2026 06:05 · coletado 10/11 07:00

    Apple iOS 27.2.1 Fixes Multiple Security Flaws Affecting Messaging and Wireless Pairing

    ler a análise desta fonte

    Apple released iOS 27.2.1 and iPadOS 27.2.1 on November 9, 2026, to address nine security vulnerabilities impacting iMessage, Bluetooth, AirPlay, and the brotli compression library. The update patches several flaws including use-after-free, authorization bypasses, and memory corruption, many of which could allow remote or local attackers to execute code or read private messages. Most fixes target wireless pairing mechanisms, with several vulnerabilities involving bypassing rate limits and executing unprompted pairings. Users with compatible devices are advised to update promptly. Apple credits its own team and external researchers for discovering these issues, which as of now are not known to be exploited in attacks.

  7. securityonline.info ↗ · pub. 09/11/2026 23:48 · coletado 10/11 00:00 primeiro registro

    iOS 27.2.1 Security Update Closes Critical iMessage and Wireless Flaws

    ler a análise desta fonte

    Apple has released iOS 27.2.1, addressing multiple critical security vulnerabilities affecting privacy and wireless connections. Key flaws include a CVE-2026-113961 authorization issue in messaging, allowing unauthorized access to group chats, and CVE-2026-113960 that could expose chat history upon member invitation. Wireless vulnerabilities like CVE-2026-113965 enable malicious peripherals to pair silently, while others (CVE-2026-113964, CVE-2026-113968, CVE-2026-113969) allow brute-force bypasses of Bluetooth and AirPlay authentication. Apple also backported these fixes to older iOS versions to protect legacy devices.