Log in Start free

Actively exploited · Published May 13, 2024 · Assigned by apple

CVE-2024-27834

Medium 5.5 Exploited

In plain English

A medium-severity improper authentication in iOS and iPadOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on November 4, 2026). The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)1.5%top 25.6% of all CVEs
Exploited in the wildYesCISA KEV since Nov 4, 2026
Attack toolingNoneno public tooling known

CISA guidance

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Federal agencies must remediate by Nov 18, 2026.

Official description

The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8webkit2gtk32.46.3-1.el8_10ALSA-2024:9636
AlmaLinux:8webkit2gtk3-devel2.46.3-1.el8_10ALSA-2024:9636
AlmaLinux:8webkit2gtk3-jsc2.46.3-1.el8_10ALSA-2024:9636
AlmaLinux:8webkit2gtk3-jsc-devel2.46.3-1.el8_10ALSA-2024:9636
Debian:12webkit2gtk2.44.2-1~deb12u1DEBIAN-CVE-2024-27834
Debian:12webkit2gtk2.44.2-1~deb12u1DSA-5695-1
Debian:13webkit2gtk2.44.2-1DEBIAN-CVE-2024-27834
Debian:14webkit2gtk2.44.2-1DEBIAN-CVE-2024-27834
Debian:12wpewebkitno fix listedDEBIAN-CVE-2024-27834
Debian:13wpewebkit2.44.2-1DEBIAN-CVE-2024-27834
Debian:14wpewebkit2.44.2-1DEBIAN-CVE-2024-27834
Ubuntu:22.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2024-27834
Ubuntu:24.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2024-27834
Ubuntu:22.04:LTSwebkit2gtk2.44.2-0ubuntu0.22.04.1UBUNTU-CVE-2024-27834
Ubuntu:22.04:LTSwebkit2gtk2.44.2-0ubuntu0.22.04.1USN-6788-1
Ubuntu:24.04:LTSwebkit2gtk2.44.2-0ubuntu0.24.04.1USN-6788-1
Ubuntu:24.04:LTSwebkit2gtk2.44.2-0ubuntu0.24.04.1UBUNTU-CVE-2024-27834
Ubuntu:22.04:LTSwpewebkitno fix listedUBUNTU-CVE-2024-27834

Affected products (as reported)

VendorProductVersions
Apple Safari 0 – before 17.5
Apple iOS and iPadOS 0 – before 16.7.80 – before 17.5
Apple macOS 0 – before 14.5
Apple tvOS 0 – before 17.5
Apple watchOS 0 – before 10.5

Weakness: CWE-287 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References