Apple WebKit: pointer authentication bypass (CVE-2024-27834) reported exploited, fixed in iOS, iPadOS, Safari 17.5
Published 05/11/2026 02:04
Timeline
3 events over 1 d 1 h
- 04/11/2026ConfirmedCISA Known Exploited Vulnerabilities+0 min
- 04/11/2026ExploitedCISA Known Exploited Vulnerabilities+1 d 1 h
- 05/11/2026 02:04Published on WatchtowerPro CISO
In short
Apple fixed a WebKit flaw (CVE-2024-27834) that lets an attacker who can already read and write memory bypass Pointer Authentication. VulnCheck KEV reports it exploited, citing a Sekoia report on APT29 watering-hole attacks. Update Apple devices and browsers to the fixed releases. GreyNoise reports a public exploit for CVE-2024-27834; listed by CISA as known exploited (05/11/2026).
How bad is it
Medium. An attacker who already has the ability to read and write memory in a device's web content engine may be able to bypass a protection and make an attack chain more reliable.
Being exploited - on CISA's known-exploited list since 04/11/2026.
Severity score
CVSS 3.1 from NVD, read 05/11/2026.
What an attacker needs
- Internet access to itLocal access needed
- A loginA user account
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Change or delete that data
Type: memory corruption.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Safari, iOS and iPadOS, macOS Sonoma, tvOS, watchOS and WebKitGTK/WPE WebKit versions before the fixed releases are listed as affected by NVD.
- NVD also lists Fedora 39 and 40 as affected.
- Safari 17.5 is the fix for macOS Monterey and Ventura; Sonoma users get the fix through macOS 14.5.
Fixed in
- Safari 17.5
- iOS 16.7.8 and iPadOS 16.7.8
- iOS 17.5 and iPadOS 17.5
- macOS Sonoma 14.5
- tvOS 17.5
- watchOS 10.5
What to do now
- Update iOS and iPadOS to 17.5 or later (16.7.8 for devices that stay on 16.x), macOS to 14.5 or later, Safari to 17.5 or later, tvOS to 17.5 and watchOS to 10.5.
- Update WebKitGTK to 2.44.2 or later through your Linux distribution's packages; Red Hat has shipped WebKitGTK updates that list this CVE (RHSA-2024:9636).
- No vendor interim measure is known, so updating is the only fix.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 6 sources with their dates. And technology matching: which of your systems run Apple iOS, iPadOS, macOS, Safari, tvOS, watchOS, at which version, fixed or not - and what each one needs.
Main sources
Known exploited: Apple Multiple Products - Apple Multiple Products Improper Authentication Vulnerability Vendor · Known exploited (VulnCheck KEV): Apple safari - CVE-2024-27834 Research · CVE-2024-27834 Detail - NVD Research