Apple has fixed a serious vulnerability that could allow conversations to be eavesdropped on via wireless earphones.

Apple sells its own wireless earphones, AirPods , as well as earphones and headphones under the Beats brand, which it acquired in 2014. A vulnerability was found in Beats Studio Buds , a pair of wireless earphones from the Beats brand, that allowed for eavesdropping on conversations, but this has finally been fixed with a software update.

About the security content of Beats Firmware Update 1B211 - Apple Support
https://support.apple.com/en-us/127557

Apple patches eavesdropping vulnerability in Beats Studio Buds
https://arstechnica.com/apple/2026/06/apple-patches-high-severity-eavesdropping-vulnerability-in-beats-studio-buds/

The vulnerability in question is ' CVE-2025-20701 ,' a bug in the Bluetooth audio SDK provided by Airoha , a subsidiary of MediaTek . This SDK has a vulnerability that allows Bluetooth audio devices to be paired without the user's consent, which in turn allows for remote privilege escalation without additional execution privileges. The severity rating for CVE-2025-20701 is 8.8 out of 10.

CVE Record: CVE-2025-20701
https://www.cve.org/CVERecord?id=CVE-2025-20701

Exploiting this vulnerability could allow someone within range of a Bluetooth device to pair a different device with Beats Studio Buds than the one originally paired. This could potentially allow them to eavesdrop on phone calls and conversations.

CVE-2025-20701 was first reported in June 2025 by Dennis Einse and Frieder Steinmetz, researchers at the security firm Insinuator. Einse and Steinmetz claim that CVE-2025-20701 can be used by attackers to obtain call history and contacts from a target device, make calls to arbitrary numbers, and perform other malicious activities.

Apple fixed this vulnerability in firmware update '1B211' for Beats Studio Buds, which was released on June 16, 2026, local time.

To perform a firmware update for your Beats Studio Buds, on an iPhone or iPad, open the 'Settings' app and then 'Bluetooth,' or on a Mac, open 'System Settings' and then 'Bluetooth,' and then tap the information button next to the headphones.

Instructions on how to update your Beats earphones are summarized on the following page.

Update your Beats - Apple Support (Japan)
https://support.apple.com/ja-jp/guide/beats/dev3381eab1b/web

Jabra, another earphone manufacturer affected by CVE-2025-20701, has released a firmware update for its Bluetooth adapter, the Jabra Link 390. However, Jabra did not fix CVE-2025-20701 until December 2025. In addition to Jabra, other audio equipment manufacturers such as Sony, Bose, JBL, and Marshall have alreadyreleased firmware updates to address CVE-2025-20701 in early 2026.

See the latest release notes for Jabra Link 390
https://www.jabra.com/cs-cz/support/release-notes/release-note-jabra-link-390

Ars Technica reports that there have been very few reports of CVE-2025-20701 actually being exploited, as the conditions for carrying out the attack are complex, including the need to be close to the device. If you are using wireless earphones that may be affected by CVE-2025-20701, you can eliminate the risk of becoming a target of the attack by turning off the device's Bluetooth when not in use. However, the most reliable solution is to install a firmware update that addresses CVE-2025-20701.