An iMessage flaw may let a distant attacker be a part of a gaggle chat and obtain its messages, Apple mentioned yesterday, and it launched updates to repair it. The updates additionally repair a separate iMessage flaw that might let somebody added to a gaggle entry messages despatched earlier than they joined.
As of right this moment, different updates launched yesterday for the iPhone XS, XS Max and XR, the iPad (seventh technology) and a few Apple Watch fashions don’t record both repair.
The corporate’s notes additionally don’t say whether or not both flaw has been exploited, what an attacker would want, whether or not group members would see somebody who joined this fashion, or whether or not each member should replace to be protected.
The updates that repair the iMessage flaws additionally repair a flaw in Google’s Brotli compression library. The notes don’t point out any assaults utilizing that flaw. The U.S. Cybersecurity and Infrastructure Safety Company (CISA) added it to its Identified Exploited Vulnerabilities catalog on October 27.
The flaw that might let a distant attacker be a part of a gaggle chat is tracked as CVE-2026-113961. It’s an authorization situation that the updates repair via improved validation. The flaw involving earlier messages is CVE-2026-113960.
Which Updates Carry the Fixes
Every working system model obtained its personal replace. The safety advisory for iOS and iPadOS 27.2.1 describes all three flaws. The safety releases record hyperlinks to the notes for each replace.
The iOS 18.7.12 notes and the watchOS 26.6.1 notes record different safety fixes however not the iMessage or Brotli fixes.
The corporate doesn’t say whether or not units on these variations are affected by the three flaws. Its notes additionally supply no workaround for anybody who can not replace instantly.
The Brotli flaw, CVE-2026-111497, is an out-of-bounds write within the library’s decoder that might let malicious enter corrupt reminiscence. CISA’s catalog entry for the Brotli decoder flaw names Google’s Brotli because the affected product and says totally different merchandise may use the element.
All 9 updates repair Bluetooth and AirPlay flaws. Two may enable a malicious Bluetooth machine, or an attacker inside Bluetooth vary, to pair with a tool with out consumer interplay. The notes don’t say what a paired machine may then do.
Two others may let an attacker bypass the restrict on pairing code makes an attempt, one from Bluetooth vary and one from the identical community. One other may let an attacker in Bluetooth vary corrupt course of reminiscence.
