Apple Addresses Nine Security Vulnerabilities in iOS 27.2.1, Including Bluetooth and iMessage Flaws

Apple has issued an update for its mobile operating systems, releasing iOS 27.2.1 and iPadOS 27.2.1 to address a total of nine security vulnerabilities. The patches target critical flaws in core system components including Bluetooth, AirPlay, and the Messages application, with the update available for iPhone 11 and later models, as well as several recent iPad models.

Several of the vulnerabilities revolve around Bluetooth pairing mechanisms. Two flaws in the CoreUtils component, identified as CVE-2026-113964 and CVE-2026-113965, could allow unauthorized devices to pair with an Apple device. CVE-2026-113964, reported by an anonymous researcher, could enable an attacker within Bluetooth range to bypass pairing code limits and initiate pairing without user interaction. The second CoreUtils vulnerability, CVE-2026-113965, discovered by Apple itself, could permit a malicious Bluetooth device to pair autonomously.

Further Bluetooth and AirPlay vulnerabilities were also addressed. CVE-2026-113968, affecting AirPlay, could allow an attacker within Bluetooth range to bypass pairing code attempt limits. Similarly, CVE-2026-113969, found in rapportd, could enable a user on the same network to bypass AirPlay pairing limits. A use-after-free vulnerability in Bluetooth, CVE-2026-113970, could lead to memory corruption if exploited by an attacker within Bluetooth range.

The Messages application received fixes for two distinct vulnerabilities. CVE-2026-113961 could allow a remote attacker to join an iMessage group chat and read its messages, a vulnerability patched by implementing more robust join checks. Another flaw, CVE-2026-113960, permitted users added to a group chat to access messages sent prior to their inclusion, which has been rectified by removing the underlying code.

Beyond connectivity features, the update also resolves a vulnerability in App Intents, CVE-2026-113963, which could have allowed an application to access sensitive user data. This was fixed by enhancing authorization checks. Additionally, a flaw in the brotli compression library, CVE-2026-111497, could be triggered by a specially crafted file to cause an out-of-bounds write, potentially leading to memory corruption. This issue was addressed through improved input validation.

Apple has stated that none of these vulnerabilities were known to be exploited in the wild prior to the release of the update. Users are advised to install iOS 27.2.1 or iPadOS 27.2.1 by navigating to Settings > General > Software Update. Apple also notes that updates cannot be rolled back once installed.

While the update addresses numerous issues, the focus on pairing vulnerabilities highlights a persistent attack vector. The fixes for AirPlay and Bluetooth pairing serve as a reminder that sophisticated attacks do not always require malware, and sometimes rely on exploiting system logic and user interaction protocols.

This release follows a period of heightened security awareness for Apple devices, with previous updates addressing critical flaws such as remote code execution vulnerabilities in WebKit and other components, underscoring the company's ongoing efforts to maintain the security posture of its ecosystem.