The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
CVE-2024-27834
CVSS base score
5.5 (v3.1)
Severity
MEDIUM
Attack vector
Local
Weakness
CWE-287
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
apple safari
apple ipados
apple iphone os
apple macos
apple tvos
apple watchos
webkitgtk webkitgtk
wpewebkit wpe webkit
fedoraproject fedora
References
- support.apple.com Vendor Advisory, Release Notes
- support.apple.com Vendor Advisory, Release Notes
- support.apple.com Vendor Advisory, Release Notes
- support.apple.com Vendor Advisory, Release Notes
- support.apple.com Vendor Advisory, Release Notes
- support.apple.com Vendor Advisory, Release Notes
- seclists.org Mailing List, Third Party Advisory
- seclists.org Mailing List, Third Party Advisory
- seclists.org Mailing List, Third Party Advisory
- seclists.org Mailing List, Third Party Advisory