Apple releases iOS 27.2.1 and macOS 27.2.1 with security fixes

The iOS 27.2.1, iPadOS 27.2.1 and macOS Golden Gate 27.2.1 updates fix two vulnerabilities in iMessage group chats, one of which could let an outsider remotely join a conversation.

iMessage chat access checks

Apple strengthened permission checks for joining a group. Before the update, a CVE-2026-113961 bug could let an outsider join a chat and receive messages.

The company also removed code that could let a newly added group member access messages sent before they joined (CVE-2026-113960).

AirPlay and Bluetooth pairing

Apple changed AirPlay’s pairing logic to prevent bypassing the limit on passcode attempts. Before the update, one bug made it possible to bypass the limit within Bluetooth range, and another did so from the same network. In CoreUtils, the company fixed two more bugs that could allow pairing without the owner’s involvement. In one case, a malicious Bluetooth device could initiate it; in the other, an attacker nearby could first bypass the passcode-attempt limit.

In Bluetooth, Apple fixed a use-after-free bug that could let an attacker nearby corrupt process memory. In the brotli library, the company strengthened input validation to prevent specially crafted data from causing an out-of-bounds write. Apple also fixed an authorization bug in App Intents on iPhone and iPad that could give an app access to sensitive data.

Blocking eMudhra certificates on Mac

After the update, the curl and git system utilities will no longer accept 12 compromised eMudhra TLS certificates. Safari and Mail had already been blocking these certificates. Apple extended the block to macOS and Xcode command-line tools and removed five root certificates from the system file /etc/ssl/cert.pem. The same changes are included in macOS Tahoe 26.7.3 and macOS Sequoia 15.8.3.

Which devices received the updates

iOS 27.2.1 is available for iPhone 11 and later. iPadOS 27.2.1 supports iPad (9th generation and later), iPad mini (6th generation and later), iPad Air (4th generation and later), 11-inch iPad Pro (2nd generation and later), 12.9-inch iPad Pro (4th generation and later), and 13-inch iPad Pro. macOS 27.2.1 is available on all Macs that support macOS Golden Gate.

Both iMessage fixes are also included in iOS and iPadOS 26.7.3, macOS Tahoe 26.7.3 and macOS Sequoia 15.8.3. iOS and iPadOS 18.7.12, with AirPlay and Bluetooth fixes, were released for iPhone XS, XS Max and XR, as well as the 7th-generation iPad.

On iPhone and iPad, install the update via Settings → General → Software Update. On Mac, find this section in System Settings → General.