---
id: "CVE-2024-27834"
kind: "vulnerability"
aliases: ["CVE-2024-27834"]
title: "Apple iOS, macOS, Safari: pointer authentication bypass exploited in the wild"
severity: "high"
cvss: 5.5
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Apple Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "apple safari", "fixed": ["17.5"], "affected": "< 17.5", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["17.5"], "affected": "< 17.5", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["17.5"], "affected": "< 17.5", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["14.5"], "affected": ">= 14.0, < 14.5", "ecosystem": "vendor"}, {"name": "apple tvos", "fixed": ["17.5"], "affected": "< 17.5", "ecosystem": "vendor"}, {"name": "apple watchos", "fixed": ["10.5"], "affected": "< 10.5", "ecosystem": "vendor"}, {"name": "webkitgtk", "fixed": ["2.44.2"], "affected": "< 2.44.2", "ecosystem": "vendor"}, {"name": "wpewebkit wpe webkit", "fixed": ["2.44.2"], "affected": "< 2.44.2", "ecosystem": "vendor"}, {"name": "fedoraproject fedora", "fixed": [], "affected": "= 39", "ecosystem": "vendor"}, {"name": "fedoraproject fedora", "fixed": [], "affected": "= 40", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apple", "exploited", "ios", "macos", "mobile", "safari", "vendor"]
not_affected_if: ["fully-patched-devices"]
published_at: "2024-05-14T15:13:06+00:00"
first_seen_at: "2026-11-04T20:56:49+00:00"
updated_at: "2026-11-04T22:13:30+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27834", "first_seen_at": "2026-11-04T20:56:49+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27834", "first_seen_at": "2026-11-04T20:59:06+00:00"}]
exploit_sources: [{"type": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27834", "date_added": "2026-11-04", "due_date": "2026-11-18", "ransomware": "Unknown"}]
---

# Apple iOS, macOS, Safari: pointer authentication bypass exploited in the wild

Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 have an improper authentication flaw that lets an attacker with arbitrary read and write capability bypass pointer authentication. CISA lists it as known exploited, and a linked report ties n-day exploits to APT29 watering-hole attacks on mobile devices.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple Multiple Products affected ? fixed ?
- vendor:apple safari affected < 17.5 fixed 17.5
- vendor:apple ipados affected < 17.5 fixed 17.5
- vendor:apple iphone os affected < 17.5 fixed 17.5
- vendor:apple macos affected >= 14.0, < 14.5 fixed 14.5
- vendor:apple tvos affected < 17.5 fixed 17.5
- vendor:apple watchos affected < 10.5 fixed 10.5
- vendor:webkitgtk affected < 2.44.2 fixed 2.44.2
- vendor:wpewebkit wpe webkit affected < 2.44.2 fixed 2.44.2
- vendor:fedoraproject fedora affected = 39 fixed ?
- vendor:fedoraproject fedora affected = 40 fixed ?

## How to check

- Check the device OS version under Settings > General > About (iOS, iPadOS) or About This Mac (macOS) and compare it with the fixed versions.
- Check the Safari and tvOS/watchOS versions in the same place for each device type in use.

## Fix

- Update iOS, iPadOS, macOS, Safari, tvOS and watchOS to a release newer than 10.5; the exact fixed versions are unknown from the sources.

## Timeline

- 2026-11-04T20:56:49+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-27834
- 2026-11-04T20:59:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-27834

## Documents

- [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/HT214101
- [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/HT214102
- [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/HT214103
- [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/HT214104
- [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/HT214106
- [mentions] Poisoned Source: APT29 watering holes target mobile devices with n-day exploits https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits

## From the sources

Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_