Back to vendor advisories
Apple Security Releases149721

tvOS 27.2.1

Severity not listed 6 CVEs Published Nov 13, 2026 at 12:00 AM UTC

Summary

No separate summary was provided in the collected bulletin.

View 6 component changes
AirPlay

Available for: Apple TV 4K 2nd generation and later

Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts

Description: A logic issue was addressed with improved state management.

CVE-2026-113968: Apple

App Intents

Available for: Apple TV 4K 2nd generation and later

Impact: An app may be able to access sensitive user data

Description: An authorization issue was addressed with improved state management.

CVE-2026-113963: László Várady

Bluetooth

Available for: Apple TV 4K 2nd generation and later

Impact: An attacker in Bluetooth range may be able to corrupt process memory

Description: A use-after-free issue was addressed with improved memory management.

CVE-2026-113970: Apple

CoreUtils

Available for: Apple TV 4K 2nd generation and later

Impact: A malicious Bluetooth device may be able to establish a pairing without user interaction

Description: This issue was addressed with improved checks.

CVE-2026-113965: Apple

CoreUtils

Available for: Apple TV 4K 2nd generation and later

Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction

Description: A logic issue was addressed with improved state management.

CVE-2026-113964: an anonymous researcher

rapportd

Available for: Apple TV 4K 2nd generation and later

Impact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts

Description: A logic issue was addressed with improved state management.

CVE-2026-113969: Apple

Products covered

  • Apple TV 4K 2nd generation and later

Remediation

Separate remediation guidance was not included in the collected bulletin.

CVEs in this advisory 6

Updates

  1. Published by Apple Security Releases

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.