Apple has released tvOS 27.2.1 with fixes for seven security vulnerabilities, including Bluetooth flaws that could allow pairing without the user's involvement. The update arrived November 13 for Apple TV 4K 2nd generation and later, with every listed fix covering those models. The vulnerabilities extend beyond Bluetooth: Apple also addressed an AirPlay pairing weakness, possible exposure of sensitive user data and memory corruption.
Two of the Bluetooth vulnerabilities concern pairing that could happen without user interaction, though Apple describes different paths to that outcome. For CVE-2026-113965, Apple says a malicious Bluetooth device could potentially pair without the user taking action; the company added checks to address it. For CVE-2026-113964, a nearby attacker could potentially evade the limit on pairing-code guesses and pair without user interaction, a logic flaw Apple fixed by changing state management.
Read more: Apple watchOS 26.6.1 Fixes Five Pairing and Memory Flaws
A separate Bluetooth flaw, CVE-2026-113968, could let an attacker within radio range get around the cap on pairing-code attempts. Apple addressed that logic issue through changes to state management as well. The AirPlay vulnerability, CVE-2026-113969, concerns an attacker sharing the network who could potentially evade the limit on attempts to guess an AirPlay pairing code; Apple used a state-management fix for that issue too.
Another repair addresses the possibility that an app could obtain sensitive information belonging to the user. Apple identifies that vulnerability as CVE-2026-113963, credits László Várady and says changes to state management corrected the authorization flaw. Apple credits an anonymous researcher for CVE-2026-113964 and itself for the other three pairing-related vulnerabilities.
The remaining two fixes address memory corruption through different mechanisms. CVE-2026-113970 could allow a nearby Bluetooth attacker to corrupt a process's memory; Apple corrected a use-after-free flaw through memory-management changes. For CVE-2026-111497, specially crafted input could trigger memory corruption through an out-of-bounds write, which Apple addressed by strengthening input validation.
The tvOS release follows Apple's November 9 releases of iOS 27.2.1 and iPadOS 27.2.1 for supported iPhone and iPad models. Apple also released iOS 18.7.12 and iPadOS 18.7.12 that day for iPhone XS, iPhone XS Max, iPhone XR and iPad 7th generation.
