AppleAnalysisApple resolves proximity memory corruption and bypass flaws in CoreUtils
What happened.Apple released security updates resolving multiple wireless memory corruption and pairing bypass vulnerabilities in the CoreUtils subsystem across its operating systems.
Why it matters.Enterprise employees use mobile devices and laptops in public and corporate spaces with active wireless radios. When proximity protocols fail to enforce pairing rate limits, nearby attackers connect without physical interaction and compromise local process memory. Enterprise fleet administrators should enforce immediate OS updates across employee hardware. Security teams should advise users to disable Bluetooth when operating in untrusted environments.
The technical specifications:
- Vulnerability mechanics: Tracked under CVE-2026-113968 and CVE-2026-113970, the defects include logic errors and use-after-free flaws in AirPlay and Bluetooth pairing.
- Proximity vector: Attackers within physical wireless range exploit flawed state machines to bypass pairing-code rate limits during device negotiation.
- Memory corruption: Malicious connection sequences corrupt wireless daemon memory to execute arbitrary code with local service privileges.
- System coverage: Apple deployed fixes across iOS 27.2.1, iPadOS 27.2.1, macOS Golden Gate 27.2.1, and maintenance builds for earlier operating systems.
- Remediation updates: Apple resolved the flaws by tightening state management and improving boundary checks across CoreUtils wireless handlers.