PatchTheCVECVE-2024-27834: Apple Multiple Products Improper Authentication Vulnerability
CVE-2024-27834 is a medium-severity flaw (CVSS 5.5) affecting safari, ipados, iphone os, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
Why this priority
- Exploited in the wild (CISA KEV)
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.5 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 51%) |
| CISA exploited list | Yes, fix due 2026-11-18 |
| Weakness | CWE-287 |
| Published | 2024-05-14 |
| Last modified | 2026-11-04 |
Last updated 2026-11-04 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Updated Record last modified
- Deadline CISA due date for US federal agencies to patch
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-27834?
safari: upgrade to 17.5; ipados: upgrade to 17.5; iphone os: upgrade to 17.5. Exact commands for each OS are on this page.
Is CVE-2024-27834 being exploited?
Yes. CVE-2024-27834 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.
What does CVE-2024-27834 affect?
CVE-2024-27834 affects safari, ipados, iphone os. Severity is medium (CVSS 5.5). The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may b
How urgent is CVE-2024-27834?
Priority 56/100. Exploited in the wild (CISA KEV)
Software pages
iOS vulnerabilities · macOS vulnerabilities · Safari vulnerabilities · Apple Safari and WebKit vulnerabilities · iPadOS vulnerabilities · watchOS vulnerabilities
Related CVEs
- CVE-2026-86973 MEDIUM 6.5 UPGRADE UPGRADE An out-of-bounds read was addressed with improved bounds checking
- CVE-2026-86974 HIGH 7.5 UPGRADE UPGRADE A type confusion issue was addressed with improved checks
- CVE-2024-54505 HIGH 8.8 UPGRADE UPGRADE A type confusion issue was addressed with improved memory handling
- CVE-2026-86985 MEDIUM 6.5 UPGRADE UPGRADE This issue was addressed with improved input validation
- CVE-2026-86986 HIGH 7.5 UPGRADE UPGRADE A use-after-free issue was addressed with improved memory management