Apple has fixed a flaw in iMessage that could let a remote attacker join a group chat they were never invited to and receive its messages. The fix arrived in iOS and iPadOS 27.2.1, released on 9 November 2026, and Apple is urging owners of supported iPhones and iPads to install it.

The flaw, tracked as CVE-2026-113961, is an authorisation issue in the Messages app. Apple says it fixed the problem through improved validation, so an outsider can no longer slip into a conversation uninvited. The update also fixes a second iMessage flaw, CVE-2026-113960, which could let someone added to a group read messages sent before they joined. Apple says it removed the vulnerable code behind that flaw.

Both flaws were reported by anonymous security researchers. Apple has not said whether either flaw has been exploited in real attacks, what an attacker would need to trigger them, whether other members of a group would notice someone joining this way, or whether every member of a chat must update to be protected.

Nine flaws fixed in iOS 27.2.1

The update fixes nine security vulnerabilities in total, affecting Messages, Bluetooth, AirPlay, App Intents, CoreUtils, the Brotli compression library and a system component called rapportd. It is available for the iPhone 11 and later, and for supported iPads.

The same release also fixes a flaw in Google's Brotli compression library, tracked as CVE-2026-111497. It is an out-of-bounds write in the library's decoder that could let malicious input corrupt memory. The US Cybersecurity and Infrastructure Security Agency (CISA) added the Brotli flaw to its Known Exploited Vulnerabilities catalogue on 27 October 2026, meaning exploitation has been confirmed somewhere in the wider ecosystem. Apple's notes do not mention any attacks using the flaw against its own devices.

Several of the Bluetooth flaws fixed in the same update are also worth attention. Two could allow a malicious Bluetooth device, or an attacker within Bluetooth range, to pair with a device without any user interaction. Two others could let an attacker bypass the limit on pairing code attempts, one from Bluetooth range and one from the same network, while another could let an attacker in Bluetooth range corrupt process memory. Apple has not said what a device paired in this way could then do.

Older iPhones do not list the fixes

Apple also released updates on the same day for older hardware, including the iPhone XS, XS Max and XR, the seventh-generation iPad and some Apple Watch models. Those updates, including iOS 18.7.12 and watchOS 26.6.1, list other security fixes but do not mention either iMessage flaw or the Brotli flaw. Apple has not said whether devices running those versions are affected by the three flaws, and its notes offer no workaround for anyone who cannot update straight away.

The iMessage fixes also shipped for Mac, Apple Watch and Vision Pro in their matching updates. But the iOS and iPadOS 27.2.1 advisory is the one that describes all three flaws, and it is the only iPhone and iPad release that names the iMessage fixes.

How to update your iPhone

Owners of a supported iPhone or iPad should install the update now. On an iPhone, go to Settings, then General, then Software Update, and follow the on-screen steps. The update carries no new features: Apple's release note says only that it provides bug fixes and security updates.

Group chats are used for family conversations, work discussions and school groups, so a flaw that lets a stranger read them is a serious privacy risk even without evidence of exploitation. Updating closes the hole, and anyone still running an older iPhone should check whether their device is covered and what Apple says about its own update.

As reported by The Hacker News, Apple has not confirmed any real-world exploitation of the iMessage flaws. As reported by GBHackers, the update fixes nine vulnerabilities in total, and users should apply it promptly.