---
title: "iOS 27.2.1 fixes iMessage group chat flaws and Bluetooth pairing bugs"
description: "Apple's 9 November update patches nine CVEs, from iMessage group access to Bluetooth pairing rate limits."
url: https://mactoreality.com/ios-27-2-1-security-update-imessage-group-bluetooth-pairing
published: 2026-11-10T00:31:03Z
updated: 2026-11-10T00:31:03Z
author: "Martin"
category: News
publisher: Mac to Reality
apple_heat_impact: 0
---

# iOS 27.2.1 fixes iMessage group chat flaws and Bluetooth pairing bugs

*Apple's 9 November update patches nine CVEs, from iMessage group access to Bluetooth pairing rate limits.*

**Key points**

- iOS 27.2.1 and iPadOS 27.2.1 fix nine security vulnerabilities.
- Two Messages fixes cover iMessage group chat access.
- Several Bluetooth and AirPlay pairing flaws are patched; older iOS 26.7.3 and 18.7.12 also shipped.

Apple has released iOS 27.2.1 and iPadOS 27.2.1 with fixes for nine security vulnerabilities, including two in Messages that could expose iMessage group chats and several in Bluetooth pairing.

The update is available for iPhone 11 and later and a wide range of iPads, and Apple’s security notes list it as released on 9 November 2026. Apple shipped matching updates the same day for older software lines (iOS 26.7.3 and iOS 18.7.12), macOS, watchOS and visionOS.

### Background

- Released: 9 November 2026
- Fixes: nine CVEs across AirPlay, App Intents, Bluetooth, brotli, CoreUtils, Messages and rapportd
- Works on: iPhone 11 and later; iPad Pro, iPad Air 4th generation and later, iPad 9th generation and later, iPad mini 6th generation and later
- Also updated: iOS 26.7.3, iOS 18.7.12, macOS 27.2.1, watchOS 27.2.1, visionOS 27.2.1

## Messages and iMessage groups

Two fixes concern Messages. In one, Apple says a remote attacker may have been able to join an iMessage group chat and receive its messages (CVE-2026-113961), which it fixed with improved validation. In the other, a user added to a group may have been able to read messages sent before they joined (CVE-2026-113960); Apple removed the vulnerable code. Both were reported by an anonymous researcher.

## Bluetooth and AirPlay pairing

Five entries cover pairing. Apple fixed a rate-limit bypass on pairing code attempts in AirPlay, CoreUtils and rapportd, which could let an attacker in Bluetooth range or on the same network keep guessing codes. One CoreUtils fix (CVE-2026-113965) addresses a malicious Bluetooth device that could establish a pairing without user interaction. A separate Bluetooth use-after-free (CVE-2026-113970) could let a nearby attacker corrupt process memory.

## Other fixes

App Intents had an authorisation issue that let an app access sensitive user data (CVE-2026-113963, credited to László Várady). A brotli out-of-bounds write could cause memory corruption when processing maliciously crafted input (CVE-2026-111497).

## What to do

Install it from Settings > General > Software Update. Apple doesn’t say any of the issues were exploited in the wild, and it keeps older iPhones covered with iOS 26.7.3 and, for iPhone XS, XS Max and XR, iOS 18.7.12.

## Sources

- [Apple Support: About the security content of iOS 27.2.1 and iPadOS 27.2.1](https://support.apple.com/en-gb/149715)