CVE-2026-113964: Input Validation

Published Nov 9, 2026
·
Updated

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction.

Other sources

AirPlay. A logic issue was addressed with improved state management.

— Apple

App Intents. An authorization issue was addressed with improved state management.

— Apple

Bluetooth. A use-after-free issue was addressed with improved memory management.

— Apple

brotli. An out-of-bounds write issue was addressed with improved input validation.

— Apple

CoreUtils. A logic issue was addressed with improved state management.

— Apple

Credit

Apple, an anonymous researcher, CVE-2026-111497, László Várady

Affected Software

3 affected componentsFixes available
Apple iOS<27.2.1
27.2.1
Apple iPadOS<27.2.1
27.2.1
Apple macOS Golden Gate<27.2.1
27.2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 27.2.1
  2. Upgrade

    Upgrade iOS/iPadOS to a version that resolves this vulnerability.

    Fixed in 18.7.12
  3. Upgrade

    Upgrade iOS/iPadOS to a version that resolves this vulnerability.

    Fixed in 26.7.3
  4. Upgrade

    Upgrade iOS/iPadOS to a version that resolves this vulnerability.

    Fixed in 27.2.1
  5. Upgrade

    Upgrade macOS Golden Gate to a version that resolves this vulnerability.

    Fixed in 27.2.1
  6. Upgrade

    Upgrade macOS Sequoia to a version that resolves this vulnerability.

    Fixed in 15.8.3
  7. Upgrade

    Upgrade macOS Tahoe to a version that resolves this vulnerability.

    Fixed in 26.7.3
  8. Upgrade

    Upgrade visionOS to a version that resolves this vulnerability.

    Fixed in 27.2.1
  9. Upgrade

    Upgrade watchOS to a version that resolves this vulnerability.

    Fixed in 26.6.1
  10. Upgrade

    Upgrade watchOS to a version that resolves this vulnerability.

    Fixed in 27.2.1

Event History

Nov 9, 2026
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
CVE Published
via MITRE·08:28 PM
Data Sourced
via MITRE·08:28 PM
DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203