Vulnerability Intelligence Report
Apple Multiple Products Improper Authentication Vulnerability
CVE-2024-27834
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
CISA KEV
SSVC: Active Exploitation
CVSS Base Score
5.5
MEDIUM
Exploitability:1.9
Impact Score:3.6
EPSS Probability:0.60%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-287 ↗CWE-287 Improper Authentication
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Apple | Safari | 0 < 17.5 (affected) |
| Apple | iOS and iPadOS | 0 < 16.7.8 (affected), 0 < 17.5 (affected) |
| Apple | macOS | 0 < 14.5 (affected) |
| Apple | tvOS | 0 < 17.5 (affected) |
| Apple | watchOS | 0 < 10.5 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Apple Inc. · Vendor · USA |
| Reserved | 2024-02-26T15:32:28 |
| Published | 2024-05-13T23:00:50 |
| Last Updated | 2026-11-04T20:58:23 |
Community Chatter & Buzz