Apple has fixed a Bluetooth flaw that could let a malicious device pair with an iPhone without the owner doing anything. The flaw, tracked as CVE-2026-113965, was closed in iOS 27.2.1 and iPadOS 27.2.1, released on 9 November 2026.

The update fixes nine security flaws in total, but the Bluetooth pairing bug stands out because it needs no tap, no code and no permission from the phone's owner. Anyone nearby with a rigged Bluetooth device could, in theory, have tried to pair silently. Apple says it added extra checks to stop the pairing going through.

What CVE-2026-113965 does

CVE-2026-113965 sits in CoreUtils, a system component involved in how Apple devices handle connections. According to Apple's security notes, as reported by GBHackers, a malicious Bluetooth device could pair without user interaction. Apple fixed the issue with improved checks.

The flaw is a logic problem rather than a crash bug: the phone was not asking the owner to confirm a pairing it should have blocked. That matters most in crowded places — on a train, in a cafe or at an airport — where a stranger's device can sit within Bluetooth range of yours for minutes at a time.

Four pairing flaws fixed in one update

CVE-2026-113965 was not the only pairing weakness in this release. Apple also fixed three related flaws that attacked the limits on pairing codes:

• CVE-2026-113964 (CoreUtils): a nearby attacker could bypass the limit on pairing-code attempts and pair without user interaction. An anonymous researcher reported it.
• CVE-2026-113968 (AirPlay): an attacker in Bluetooth range could bypass the rate limit on AirPlay pairing-code attempts.
• CVE-2026-113969 (rapportd): the same AirPlay pairing-code bypass, reachable from the same network.

A rate limit normally blocks repeated guesses at a pairing code, so skipping it makes guessing far easier. Apple addressed these with improved state management.

What else iOS 27.2.1 fixes

The same update closes a Bluetooth use-after-free bug, CVE-2026-113970, which could corrupt process memory, and a flaw in the brotli compression library, CVE-2026-111497, where crafted input could cause memory corruption. It also fixes an App Intents flaw, CVE-2026-113963, that could let an app reach sensitive user data, and two iMessage group-chat flaws, including CVE-2026-113961, which could let a remote attacker join a group chat.

The update is available for iPhone 11 and later, and for supported iPads including iPad Pro 12.9-inch (4th generation and later), iPad Air (4th generation and later), iPad (9th generation and later) and iPad mini (6th generation and later). Apple has not said that any of the nine flaws were exploited in real attacks.

What iPhone owners should do

Install iOS 27.2.1 now from Settings, then General, then Software Update, and do the same on iPad. Until the update is installed, the sensible precaution is to switch Bluetooth off when it is not in use, especially in busy public places, and to decline any pairing request that appears without explanation. A pairing prompt you did not expect is a reason to say no, not to tap through it.