Has this ever happened to you? You add someone new to an iMessage group chat, and wonder, “Huh, can they see any of the messages from before they were added?” The answer to that question is supposed to be “no.” By design, new iMessage group chat members are only privy to texts that arrive after they were added. When they join, it’s essentially a blank slate, as if you just created the group for the first time. At least, that’s how it’s intended to work.
iMessage currently has two security flaws
As it turns out, there’s a bug with iMessage that may allow new group chat members to see texts from before they were added to the chat. That’s a problem, and not just for the iPhone users out there talking smack about people before inviting them to join the group chat. It means iMessage, and Apple’s platforms in general, aren’t working like they’re supposed to be. You don’t have to be talking behind people’s backs to not want new members seeing existing chats. Maybe you’re planning a surprise party for someone, and add them to the group once everyone‘s in on the plan; maybe the texts in the chat aren’t relevant to the current group, and the person joining simply does not need to access them.
That’s not all: There exists another security flaw that could allow remote hackers to join an iMessage group and receive new messages. You might add a new user to a group chat and inadvertently invite them to read all existing messages, while at the same time being attacked by a bad actor who can then intercept all future messages. Not good.
iOS 27.2.1 patches this bug and eight more
Luckily, there’s currently a fix for these problems. Apple patched (and revealed) the bugs, along with seven other security flaws, with a series of software updates on Monday for iPhone, iPad, Mac, Apple Watch, and Vision Pro. Not all of the updates include patches for these two iMessage flaws—specifically, some of the updates for older Apple devices. But the rest, including iOS 27.2.1, macOS 27.2.1, macOS 26.7.3, macOS 15.8.3, watchOS 27.2.1, and visionOS 27.2.1, include the iMessage patches.
Each update includes its own list of patches, but, for this article, I’ll take a look at the nine patches in iOS 27.2.1. You’ll find the two iMessage bugs, plus seven other patches, in the list below:
What do you think so far?
-
AirPlay: Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts. Description: A logic issue was addressed with improved state management. CVE-2026-113968: Apple
-
App Intents: Impact: An app may be able to access sensitive user data. Description: An authorization issue was addressed with improved state management. CVE-2026-113963: László Várady
-
Bluetooth: Impact: An attacker in Bluetooth range may be able to corrupt process memory. Description: A use-after-free issue was addressed with improved memory management. CVE-2026-113970: Apple
-
brotli: Impact: Processing maliciously crafted input may lead to memory corruption. Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-111497
-
CoreUtils: Impact: A malicious Bluetooth device may be able to establish a pairing without user interaction. Description: This issue was addressed with improved checks. CVE-2026-113965: Apple
-
CoreUtils: Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction. Description: A logic issue was addressed with improved state management. CVE-2026-113964: an anonymous researcher
-
Messages: Impact: A remote attacker may be able to join an iMessage group chat and receive its messages. Description: An authorization issue was addressed with improved validation. CVE-2026-113961: an anonymous researcher
-
Messages: Impact: A user added to an iMessage group may be able to access messages sent before they joined. Description: This issue was addressed by removing the vulnerable code. CVE-2026-113960: an anonymous researcher
-
Rapportd: Impact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts. Description: A logic issue was addressed with improved state management. CVE-2026-113969: Apple
For a full accounting of the patches included in the other security updates, check out Apple’s official security releases site.
How to patch these iMessage flaws
To install Apple’s latest security updates, you’ll simply need to update your device as you usually do. On iPhone, iPad, Apple Watch, and Vision Pro, head to Settings > General > Software Update; on Mac, go to System Settings > General > Software Update. Here, follow the on-screen instructions to download and install the latest version of your device’s software.
