Vulnerability details
CVE-2024-27834
Actively exploited
Apple SafariApple iOS and iPadOSApple macOSApple tvOSApple watchOS
CVSS 3.1
5.5Medium
Official description
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
Related news
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 5.5Medium | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Apple | Safari | v < 17.5 | CVEProject cvelistV5 (CNA) |
| Apple | iOS and iPadOS | v < 16.7.8 | CVEProject cvelistV5 (CNA) |
| Apple | iOS and iPadOS | v < 17.5 | CVEProject cvelistV5 (CNA) |
| Apple | macOS | v < 14.5 | CVEProject cvelistV5 (CNA) |
| Apple | tvOS | v < 17.5 | CVEProject cvelistV5 (CNA) |
| Apple | watchOS | v < 10.5 | CVEProject cvelistV5 (CNA) |
References and advisories
25- https://support.apple.com/en-us/120896
- https://support.apple.com/en-us/120898
- https://support.apple.com/en-us/120901
- https://support.apple.com/en-us/120902
- https://support.apple.com/en-us/120903
- https://support.apple.com/en-us/120905
- https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27834 government-resource
- https://support.apple.com/en-us/HT214101 x_transferred
- https://support.apple.com/en-us/HT214106 x_transferred
- https://support.apple.com/en-us/HT214104 x_transferred
- https://support.apple.com/en-us/HT214103 x_transferred
- https://support.apple.com/en-us/HT214102 x_transferred
- http://seclists.org/fulldisclosure/2024/May/17 x_transferred
- http://www.openwall.com/lists/oss-security/2024/05/21/1 x_transferred
- http://seclists.org/fulldisclosure/2024/May/10 x_transferred
- http://seclists.org/fulldisclosure/2024/May/9 x_transferred
- http://seclists.org/fulldisclosure/2024/May/12 x_transferred
- http://seclists.org/fulldisclosure/2024/May/16 x_transferred
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WKIXADCW3O4R2OOSDZGPU55XQFE6NA3M/ x_transferred
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ADCLQW54XN37VJZNYD3UKCYATJFIMYXG/ x_transferred
- https://support.apple.com/kb/HT214106
- https://support.apple.com/kb/HT214104
- https://support.apple.com/kb/HT214102
- https://support.apple.com/kb/HT214100
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2024-05-14
- Last updated
- 2026-11-05
- State
- Published
- Assigner (CNA)
- apple
- Kolun priority
- 77 · High
CISA KEV catalog
- Date added
- 2026-11-04
- Due date
- 2026-11-18
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
1.5%
Probability of exploitation in 30 days
74.4%
Percentile (among all CVEs)
- 2026-11-051.41%
- 2026-11-030.59%
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Active
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-287Improper Authentication