Apple HomeView launches tomorrow, but its first security update is already here

While the first HomeView units won’t reach customers until tomorrow, Apple today released a software update addressing nine security vulnerabilities. Here are the details.

Apple HomeView gets its first system update

Apple today released HomeView Software Version 27.2 (build 24V526), which contains some of the security fixes the company included in recent updates to its other operating systems, including iOS 27.2, macOS 27.2 Golden Gate, and iPadOS 27.2.

These include a vulnerability that could allow a remote attacker to join an iMessage group chat and receive its messages, as well as another that could allow a malicious Bluetooth device to pair without user interaction.

In practice, this means that users who get the device starting tomorrow are advised to update it as soon as possible, since the vulnerabilities have been publicly disclosed.

Here’s the full security content of HomeView Software Version 27.2

HomeView Software Version 27.2

Released November 12, 2026

AirPlay

Available for: Apple HomeView

Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts

Description: A logic issue was addressed with improved state management.

CVE-2026-113968: Apple

App Intents

Available for: Apple HomeView

Impact: An app may be able to access sensitive user data

Description: An authorization issue was addressed with improved state management.

CVE-2026-113963: László Várady

Bluetooth

Available for: Apple HomeView

Impact: An attacker in Bluetooth range may be able to corrupt process memory

Description: A use-after-free issue was addressed with improved memory management.

CVE-2026-113970: Apple

brotli

Available for: Apple HomeView

Impact: Processing maliciously crafted input may lead to memory corruption

Description: An out-of-bounds write issue was addressed with improved input validation.

CVE-2026-111497

CoreUtils

Available for: Apple HomeView

Impact: A malicious Bluetooth device may be able to establish a pairing without user interaction

Description: This issue was addressed with improved checks.

CVE-2026-113965: Apple

CoreUtils

Available for: Apple HomeView

Impact: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction

Description: A logic issue was addressed with improved state management.

CVE-2026-113964: an anonymous researcher

Messages

Available for: Apple HomeView

Impact: A remote attacker may be able to join an iMessage group chat and receive its messages

Description: An authorization issue was addressed with improved validation.

CVE-2026-113961: an anonymous researcher

Messages

Available for: Apple HomeView

Impact: A user added to an iMessage group may be able to access messages sent before they joined

Description: This issue was addressed by removing the vulnerable code.

CVE-2026-113960: an anonymous researcher

rapportd

Available for: Apple HomeView

Impact: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts

Description: A logic issue was addressed with improved state management.

CVE-2026-113969: Apple

Earlier today, Apple also confirmed that a software update coming next month will add support for security accessories to HomeView’s Siri AI, which currently refuses to unlock doors or open garage doors via voice commands.

Be sure to catch 9to5Mac’s full review of Apple HomeView ahead of tomorrow’s launch.