CVE-2024-27834

CVE Enrichment

CVSS: 5.5 MEDIUM
EPSS: 0.60%
EPSS Percentile: 48.68%
CISA KEV: Not listed

Description

The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 14-May-2024 22:13
Last Modified: 17-Jun-2026 14:20
EPSS Date: 2026-11-03
CWE: CWE-277

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:N /
                            I:H /
                            A:N

CNA Products / Version Status

apple · ipad_os Source: CNA · 134c704f-9b21-4f2e-91b3-4a467353bcc0
Default status: unknown

0 ≤ version < 17.5 — affected (custom)

CPEs: cpe:2.3:o:apple:ipad_os:-:*:*:*:*:*:*:*
apple · iphone_os Source: CNA · 134c704f-9b21-4f2e-91b3-4a467353bcc0
Default status: unknown

0 ≤ version < 17.5 — affected (custom)

CPEs: cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*
apple · macos Source: CNA · 134c704f-9b21-4f2e-91b3-4a467353bcc0
Default status: unknown

0 ≤ version < 14.5 — affected (custom)

CPEs: cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
apple · tvos Source: CNA · 134c704f-9b21-4f2e-91b3-4a467353bcc0
Default status: unknown

0 ≤ version < 17.5 — affected (custom)

CPEs: cpe:2.3:o:apple:tvos:-:*:*:*:*:*:*:*
apple · watchos Source: CNA · 134c704f-9b21-4f2e-91b3-4a467353bcc0
Default status: unknown

0 ≤ version < 10.5 — affected (custom)

CPEs: cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Apple · Safari Source: CNA · [email protected]
Default status: unknown

0 ≤ version < 17.5 — affected (custom)
Apple · iOS and iPadOS Source: CNA · [email protected]
Default status: unknown

0 ≤ version < 16.7.8 — affected (custom)
0 ≤ version < 17.5 — affected (custom)
Apple · macOS Source: CNA · [email protected]
Default status: unknown

0 ≤ version < 14.5 — affected (custom)
Apple · tvOS Source: CNA · [email protected]
Default status: unknown

0 ≤ version < 17.5 — affected (custom)
Apple · watchOS Source: CNA · [email protected]
Default status: unknown

0 ≤ version < 10.5 — affected (custom)

Affected Products / Versions

apple / safari Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 17.5
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
apple / ipados Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 17.5
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
apple / iphone_os Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 17.5
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
apple / macos Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 14.0 · before (exclusive) 14.5
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
apple / tvos Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 17.5
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
apple / watchos Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.5
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
webkitgtk / webkitgtk Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 2.44.2
cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*
wpewebkit / wpe_webkit Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 2.44.2
cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:*
fedoraproject / fedora Source: NVD CPE · affected
Version / affected range: 39
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
fedoraproject / fedora Source: NVD CPE · affected
Version / affected range: 40
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

References

Last enrichment sync: 04-Nov-2026 19:43
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

The vulnerability in question is CVE-2024-27834 (CVSS score: 5.5), a case of improper authentication that could allow an attacker with arbitrary read and write capability to bypass Pointer Authentication. CISA Adds Patched Apple Flaw CVE-2024-27834 to KEV After Exploitation Reports
CVE-2025-43529, CVE-2024-27834. Steal iOS cookies Sekoia Details APT29-Linked Watering-Hole Campaign Using Patched Mobile Exploits
CVE-2025-43529 and CVE-2024-27834 (in iOS 16.7). Sekoia Links Watering-Hole Campaign Using N-Day Exploits to APT29

CVE (7)

Malware (1)

Threat Actors (3)

MITRE ATT&CK (15)

Vendors (3)

Products (14)

Tools (1)

Industries (4)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.