Apple Updates Fix iMessage Group-Chat and Bluetooth Pairing Flaws
Summary
Apple updates fix two iMessage group-chat flaws, a Brotli decoder out-of-bounds write, and Bluetooth/AirPlay issues. CISA added the Brotli flaw to its Known Exploited Vulnerabilities catalog; Apple did not say whether the flaws were exploited.
Key points
- CVE-2026-113961 could let a remote attacker join an iMessage group and receive its messages; Apple says the updates address it through improved validation.
- CVE-2026-113960 could let someone added to an iMessage group access messages sent before they joined.
- CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that could let malicious input corrupt memory. CISA added it to its Known Exploited Vulnerabilities catalog.
- Apple's notes do not state whether the iMessage or Brotli flaws have been exploited, and do not provide a workaround for devices that cannot be updated.
- Across nine updates, Apple also fixed Bluetooth and AirPlay flaws. Two could allow pairing without user interaction; others could bypass pairing-code attempt limits or corrupt process memory.
- Updates for the iPhone XS, XS Max, XR, iPad (7th generation), and some Apple Watch models did not list the iMessage or Brotli fixes; Apple did not clarify whether those versions are affected.
Article Details
- Vulnerability Types
- Authorization issue allowing remote group-chat access
- Access to messages sent before joining a group
- Out-of-bounds write in the Brotli decoder
- Bluetooth pairing without user interaction
- Bypass of pairing-code attempt limits
- Process-memory corruption
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-111497Google · Brotli; Siemens · Cloud Connector Configurator; +22 moreThe Brotli flaw, CVE-2026-111497, is an out-of-bounds write in the library's decoder that could let malicious input corrupt memory. CISA's catalog entry for the Brotli decoder flaw names Google's Brotli as the affectedCVE-2026-113960Apple · iOS and iPadOS; Apple · macOS; +2 moreissue that the updates fix through improved validation. The flaw involving earlier messages is CVE-2026-113960.CVE-2026-113961Apple · iOS and iPadOS; Apple · macOS; +2 moreThe flaw that could let a remote attacker join a group chat is tracked as CVE-2026-113961. It is an authorization issue that the updates fix through improved validation. The flaw involving earlier messages is
Vendors
AppleAn iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someoneGoogleThe updates that fix the iMessage flaws also fix a flaw in Google's Brotli compression library. The notes do not mention any attacks using that flaw. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)
Products
BrotliThe updates that fix the iMessage flaws also fix a flaw in Google's Brotli compression library. The notes do not mention any attacks using that flaw. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)iMessageAn iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someoneiOSEach operating system version got its own update. The security advisory for iOS and iPadOS 27.2.1 describes all three flaws. The security releases list links to the notes for every update.iPadOSEach operating system version got its own update. The security advisory for iOS and iPadOS 27.2.1 describes all three flaws. The security releases list links to the notes for every update.watchOSThe iOS 18.7.12 notes and the watchOS 26.6.1 notes list other security fixes but not the iMessage or Brotli fixes.