Do Son 
TL;DR
Apple released tvOS 27.2.1 on November 13, 2026, one day after HomeView Software Version 27.2. The tvOS 27.2.1 update fixes seven vulnerabilities, while the HomeView release fixes nine. Most let a nearby attacker abuse Bluetooth or AirPlay pairing.appaa
Both updates patch pairing bypasses, a Bluetooth memory corruption bug and a Brotli flaw that CISA lists as exploited. HomeView also gets two iMessage group chat fixes. Apple has not said whether attackers targeted its own devices.
- Total: 9 CVEs
- Severity: 1 Critical · 3 High · 5 Medium
- Actively exploited: 1 (exploited in the wild)
- Exploit Intel (PatchThis): 1 of 9 confirmed
- Highest severity: 9.2 (Critical · CVSSv4) — CVE-2026-111497
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-111497 | 9.2 | Out-of-Bounds Write in Decoder | 1.0.10, 1.1.1, 1.2.1 | Exploited |
| CVE-2026-113970 | 8.8 | CWE-416 | 27.2, 18.7.12, 26.7.3 (+3) | Not exploited |
| CVE-2026-113969 | 7.5 | CWE-693 | 27.2, 18.7.12, 26.7.3 (+3) | Not exploited |
| CVE-2026-113961 | 7.5 | CWE-863 | 27.2, 26.7.3, 27.2.1 (+1) | Not exploited |
| CVE-2026-113960 | 6.5 | CWE-284 | 27.2, 26.7.3, 27.2.1 (+1) | Not exploited |
| CVE-2026-113963 | 5.5 | CWE-863 | 27.2, 27.2.1 | Not exploited |
| CVE-2026-113965 | 5.4 | CWE-287 | 27.2, 18.7.12, 26.7.3 (+3) | Not exploited |
| CVE-2026-113964 | 5.4 | CWE-307 | 27.2, 18.7.12, 26.7.3 (+3) | Not exploited |
Why It Matters
The Brotli fix stands out. CVE-2026-111497 sits in Google’s open-source Brotli compression library. CISA added it to its Known Exploited Vulnerabilities catalog on October 27, 2026. However, CISA’s entry covers the library in general, not Apple products in particular.
The pairing bugs matter too. Several of these bugs need only Bluetooth range, with no login and no user action. As a result, anyone close to the device could try them.
How the Attack Works
Pairing Bypasses
Four bugs weaken device pairing. CVE-2026-113964 lets an attacker in Bluetooth range “bypass the rate limit on pairing code attempts and pair with a device without user interaction.” Similarly, CVE-2026-113965 lets a malicious Bluetooth device pair without user interaction. Two more bugs, in AirPlay and rapportd, also skip rate limits on pairing codes.
Memory and Data Bugs
CVE-2026-113970 is a use-after-free in Bluetooth that lets a nearby attacker “corrupt process memory.” Meanwhile, the Brotli bug lets crafted input corrupt memory. A separate App Intents flaw may let an app reach sensitive user data.
HomeView Messages Fixes
HomeView alone receives two Messages fixes. With CVE-2026-113961, “a remote attacker may be able to join an iMessage group chat and receive its messages.” The other lets a new group member read messages sent before they joined.
Affected Versions
- tvOS before 27.2.1 on Apple TV 4K (2nd generation and later)
- Apple HomeView before Software Version 27.2
Patch and Mitigation
Install the tvOS 27.2.1 update through Settings on Apple TV. Full details sit in Apple’s tvOS 27.2.1 security notes. For HomeView, update to Software Version 27.2, as described in the HomeView 27.2 advisory.
Apple rates both releases “Medium” overall. Still, given the KEV-listed Brotli flaw, apply the tvOS 27.2.1 update and the HomeView fix without delay.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
