Apple has released security updates addressing two vulnerabilities in iMessage that could expose private group conversations to unauthorised access. One flaw could allow a remote attacker to join an existing iMessage group chat and receive its messages, while another could enable a user added to a group to access messages sent before they became a member. The vulnerabilities are tracked as CVE-2026-113961 and CVE-2026-113960, respectively, and were addressed through updates released on 9 November 2026. According to Apple’s security advisories, the first issue involved an authorisation weakness that was fixed through improved validation, while the second was addressed by removing the vulnerable code. The company has not disclosed whether either vulnerability was exploited in real-world attacks, what specific conditions an attacker would need to meet, or whether existing group members would be notified if an unauthorised person joined a conversation. Apple has also not clarified whether every participant in a group conversation must install the relevant update to ensure protection. These unanswered questions leave some uncertainty around the practical impact of the flaws, although the published advisories confirm that security fixes have been made available for supported devices.
The group-chat vulnerabilities are included in Apple’s iOS 27.2.1 and iPadOS 27.2.1 updates, as well as iOS 26.7.3 and iPadOS 26.7.3. The updates also address CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli compression library. The issue affects the library’s decoder and could result in memory corruption when processing specially crafted input. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on 27 October 2026, indicating that it is among the vulnerabilities identified as exploited in the wild. Apple’s advisory describes the technical issue and its remediation through improved input validation but does not provide details about attacks involving the flaw. The security fixes also vary across Apple’s software releases. The iOS 18.7.12 update, released for older devices including the iPhone XS, XS Max and XR, does not list the two iMessage vulnerabilities or the Brotli issue among its security fixes. Similarly, watchOS 26.6.1 does not list these particular issues. Apple has not clarified whether devices receiving these older software versions are affected by the vulnerabilities or whether additional updates will be provided.
Beyond the iMessage and Brotli issues, Apple’s latest security releases address several vulnerabilities involving Bluetooth and AirPlay. The advisories describe weaknesses that could allow a malicious Bluetooth device to establish a pairing without user interaction, while other issues could enable attackers within Bluetooth range to bypass restrictions on pairing-code attempts. A separate vulnerability could allow an attacker on the same network to bypass AirPlay pairing-code rate limits. Another Bluetooth-related issue could permit an attacker within range to corrupt process memory through a use-after-free weakness. The company addressed these issues through improved security checks, changes to state management and better memory handling. The published descriptions identify the potential impact of each vulnerability but do not provide details about what an attacker might be able to access or control after successfully establishing an unauthorised pairing. The fixes are distributed across the relevant operating system releases, including iOS 27.2.1, iOS 26.7.3, macOS updates, watchOS updates and visionOS 27.2.1. Users should consult Apple’s security release information to identify the update applicable to their particular device rather than assume that every software version contains identical fixes.
The disclosures highlight the importance of keeping Apple devices updated as vulnerabilities affecting messaging, compression libraries and wireless connectivity can introduce different forms of security exposure. The two iMessage flaws are particularly relevant to privacy because they concern access to group conversations and messages shared before a participant joined. However, Apple has not confirmed whether these weaknesses were exploited or provided information about any affected users. The Brotli vulnerability also requires attention because CISA has included it in its KEV catalog, making it important for organisations and security teams to review whether their systems use affected versions of the library. Apple has published the relevant security information through its official advisories, although its documentation does not provide a workaround for devices that cannot install the applicable updates. Users and administrators are advised to review Apple’s software update notices and install the latest supported security releases for their devices. Organisations managing multiple Apple products should also verify update coverage across different operating system versions, particularly where older devices receive separate maintenance releases.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
