iOS 27.2.1 fixes Bluetooth pairing and iMessage group chat flaws

What the update fixes

Apple has released iOS 27.2.1, a small security update for the iPhone that arrived on Monday, two weeks after iOS 27.2. According to Apple Insider, the release contains no new features. Its purpose is to close several security holes in iMessage and Bluetooth.

The most serious issues involve Bluetooth pairing. Apple Insider reports that flaws in CoreUtils, a system component, let a malicious Bluetooth device pair with an iPhone and get past the limit on pairing code attempts without any action from the user. Apple says it fixed these two problems with improved checks and better state management, which is how the system keeps track of what a process is allowed to do.

A third Bluetooth-related flaw was a use-after-free bug, a memory error that can let an attacker corrupt the memory of a running process. Apple resolved it with improved memory management.

iMessage group chats were exposed

The update also addresses two iMessage problems. Before the patch, an attacker could join an iMessage group chat without permission. A second flaw let that attacker read messages sent to the group before they joined.

Apple closed both holes by removing vulnerable code and fixing an authorisation issue, according to Apple Insider. Group chats are widely used for family and work conversations, so unauthorised access could have revealed private messages.

The update also fixes an App Intents authorisation problem. App Intents is the system that lets apps perform actions for users. The flaw gave apps access to sensitive user data, and Apple patched it with improved state management.

Other fixes in the release

Alongside the iMessage and Bluetooth patches, iOS 27.2.1 fixes a Brotli issue. Brotli is a compression format used to shrink data, and the flaw was an out-of-bounds write, a type of error that can corrupt memory. Apple resolved it through improved input validation.

Apple Insider notes that this release is light compared with iOS 27.2, which carried more than 130 fixes. Even so, the site says all users should install it.

Who is affected and what to do

Any iPhone running iOS 27.2 or an earlier version of iOS 27 is exposed to the flaws described above. The Bluetooth bugs required no user interaction, which means a nearby attacker with the right equipment could have targeted a phone without the owner tapping anything.

The iMessage flaws put group chat privacy at risk, since an intruder could read past messages. Readers can find the full list of security fixes on Apple's website, and the update can be installed through the software update section of the Settings app.