On Nov 10, Apple pushed system updates across multiple platforms simultaneously, including iOS/iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1 and iPadOS 26.7.3. At the same time, Apple released iOS/iPadOS 18.7.12 for older devices such as iPhone XS, iPhone XS Max, iPhone XR and iPad (7th generation), bringing six security fixes. According to IT之家, each update came 14 days after the previous official release.
Version numbers and update overview
The build numbers for the updates are: iOS/iPadOS 27.2.1 (24B156), visionOS 27.2.1 (24N124), watchOS 27.2.1 (24S132) and iPadOS 26.7.3. IT之家 noted that due to caching issues with Apple's regional node servers, some users may see the update slightly later, typically within half an hour.
The iOS/iPadOS 18.7.12 build for older devices is 22H390, also 14 days after the previous official release (iOS 18.7.11). IT之家 said in its report that the update brings six important security fixes,
"showing that Apple has not forgotten users of older systems."
Vulnerability details: Bluetooth and AirPlay risks
According to the vulnerability list compiled by IT之家, the six flaws fixed in iOS/iPadOS 18.7.12 all affect iPhone XS, iPhone XS Max, iPhone XR and iPad (7th generation), involving components including AirPlay, Bluetooth, CoreUtils, MediaRemote and rapportd. The specific vulnerabilities and CVE numbers are as follows:
| Component | Description | Fix | CVE |
|---|---|---|---|
| AirPlay | An attacker within Bluetooth range may bypass the pairing code attempt limit | Improved state management | CVE-2026-113968 |
| Bluetooth | An attacker within Bluetooth range may corrupt process memory (use-after-free) | Improved memory management | CVE-2026-113970 |
| CoreUtils | A malicious Bluetooth device may complete pairing without user interaction | Improved security checks | CVE-2026-113965 |
| CoreUtils | An attacker within Bluetooth range may bypass the pairing code attempt limit and complete pairing without user interaction | Improved state management | CVE-2026-113964 (discoverer anonymous) |
| MediaRemote | An attacker with physical access to the device may pair it with an AirPlay receiver while locked | Restricted options offered while the device is locked | CVE-2026-113971 |
| rapportd | An attacker on the same network as the device may bypass the AirPlay pairing code attempt limit | Improved state management | CVE-2026-113969 |
Several of the flaws involve Bluetooth pairing bypass and memory corruption, potentially allowing attackers to carry out attacks from physical proximity or on the same network. Apple did not disclose in the release notes whether the vulnerabilities have been exploited in the wild.
What to watch next
As of publication, IT之家's coverage of the specific changes in iOS/iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1 and iPadOS 26.7.3 remains in the form of automated posts, with no detailed feature descriptions yet. Users can watch for changes in real-world experience after updating and whether Apple discloses further vulnerability details in subsequent security documents. Users still on older devices such as iPhone XS are advised to install iOS/iPadOS 18.7.12 as soon as possible to fix the above security risks.