Apple Patches Exploited Brotli Flaw in Out-of-Band Update
Apple has released out-of-band security updates for iPhone, iPad, Mac, Apple Watch and Vision Pro. The most urgent fix addresses an exploited flaw in Brotli, a library used to decompress data. The updates also close weaknesses in iMessage and in how devices pair over Bluetooth and AirPlay. Apple security releases
Brotli is the patch priority
A deliberately malformed Brotli stream can cause the decoder to write outside its intended memory buffer. Apple says processing such input can corrupt memory. The US Cybersecurity and Infrastructure Security Agency added the Google Brotli flaw to its Known Exploited Vulnerabilities catalogue on 27 October. The listing concerns the shared library. Exploitation on Apple devices remains unconfirmed in Apple’s advisories. CVE-2026-111497 · CISA catalogue · Apple advisory
Apple lists the Brotli fix in the iOS and iPadOS 27 and 26 updates, all three Mac releases, watchOS 27.2.1 and visionOS 27.2.1. Older iPhones, iPads and Apple Watches also received updates in this round, with separate sets of fixes. The same decoder flaw has affected other software, including Node.js. Apple’s release list · iOS and iPadOS 18 advisory · watchOS 26 advisory · BlackTree’s Node.js coverage
iMessage and device pairing
Apple fixed two distinct iMessage privacy issues. One could let a remote attacker join a group chat and receive its messages. The other could expose older messages to someone who was legitimately added to the group later. CVE-2026-113961 · CVE-2026-113960 · Apple Messages fixes
One pairing flaw could let an attacker within Bluetooth range pair without user interaction. A separate AirPlay flaw could let someone on the same network bypass the limit on pairing-code attempts. CVE-2026-113964 · CVE-2026-113969 · Apple pairing fixes
Which version to install
- iPhone and iPad. iOS and iPadOS 27.2.1, 26.7.3 or 18.7.12, depending on the device and software branch.
- Mac. macOS Golden Gate 27.2.1, Tahoe 26.7.3 or Sequoia 15.8.3.
- Apple Watch. watchOS 27.2.1 or 26.6.1.
- Apple Vision Pro. visionOS 27.2.1.
On iPhone and iPad, go to Settings → General → Software Update. On Mac, open System Settings → General → Software Update. For managed fleets, check the installed version against the device’s software branch after deployment, especially where several hardware generations are in service. Apple’s model and release list · iPhone and iPad update guide · Mac update guide
Update, 11 November 2026
Hong Kong’s GovCERT issued a high-threat alert on the Apple releases and urged administrators to patch affected systems immediately. The alert cited reports of exploitation of the Brotli flaw and provided no details of attacks against Apple devices. GovCERT alert
