CVE-2026-113971: Apple iOS vulnerability

Q: What access does an attacker need to exploit this issue?

The attacker needs physical access to the device. The issue involves pairing the device with an AirPlay receiver from the lock screen.

Q: Which releases contain the fix?

The issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, as well as iOS 26.5 and iPadOS 26.5.

Q: What configuration condition is relevant?

The affected behavior is available from the lock screen on a locked device. The provided information does not identify any additional configuration requirement.

Published Nov 9, 2026

Updated

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen.

Affected Software

2 affected components

Apple iOS<18.7.12, <26.5

Apple iPadOS<18.7.12, <26.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade iOS to a version that resolves this vulnerability.
Fixed in 18.7.12
Upgrade
Upgrade iPadOS to a version that resolves this vulnerability.
Fixed in 18.7.12
Upgrade
Upgrade iOS to a version that resolves this vulnerability.
Fixed in 26.5
Upgrade
Upgrade iPadOS to a version that resolves this vulnerability.
Fixed in 26.5
Configuration
Restrict the options offered on a locked device to prevent pairing with an AirPlay receiver from the lock screen.
iOS and iPadOS lock screen options offered on a locked device = restricted

Event History

Nov 9, 2026

CVE Published

via MITRE·08:28 PM

Data Sourced

via MITRE·08:28 PM

DescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs physical access to the device. The issue involves pairing the device with an AirPlay receiver from the lock screen.

Which releases contain the fix?

The issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, as well as iOS 26.5 and iPadOS 26.5.

What configuration condition is relevant?

The affected behavior is available from the lock screen on a locked device. The provided information does not identify any additional configuration requirement.

CVE-2026-113971: Apple iOS vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which releases contain the fix?

What configuration condition is relevant?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which releases contain the fix?

What configuration condition is relevant?