Apple Pointer Authentication Bypass (CVE-2024-27834)

CVE-2024-27834 is a flaw in WebKit, the browser engine in Safari. Apple's note describes it in one line: an attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple says it was addressed with improved checks.

Pointer Authentication, or PAC, signs the pointers that steer program control flow on modern Apple silicon. Sekoia explains that an attacker who can read and write memory still cannot simply overwrite a function pointer, because an improperly signed pointer crashes the process. A PAC bypass lets the attacker forge valid pointers and turn a memory flaw into code execution.

That makes this flaw a second-stage tool, not an entry point. The attacker needs a separate bug that already gives memory read and write inside the web content process. CISA's KEV entry lists CWE-287 (Improper Authentication), and Apple credits Manfred Paul working with Trend Micro's Zero Day Initiative (WebKit Bugzilla 272750).

How the Score Reads

Apple, the CNA, gives no CVSS score in the record. NVD and CISA's enrichment both score it CVSS 3.1 5.5 Medium with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. There is no CVSS 4.0 score in the record or NVD.

The local attack vector and the integrity-only impact explain the Medium rating. The score describes the bypass on its own, so it says little about the chain it is used in.

What CISA and Sekoia Say About Exploitation

CISA added the CVE to the Known Exploited Vulnerabilities catalog on 4 November 2026, with a due date of 18 November 2026. Its entry marks known ransomware campaign use as Unknown and forensic triage as No. The required action tells owners to apply mitigations per vendor instructions under CISA's BOD 26-04. Our KEV glossary entry explains the catalog.

The KEV entry does not describe the attacks. The reference CISA added to the CVE record is Sekoia's report of 4 November 2026 on a watering hole campaign that Sekoia attributes to APT29 with moderate to high confidence. Sekoia names CVE-2024-27834 as the PAC bypass in its Class A chain, aimed at iOS 16.7, whose final payload steals browser cookies.

Sekoia also says all of the campaign's chains use already-patched flaws and that an up-to-date device is not exposed to them. Our post on the APT29 mobile watering hole walks through the three chains. The drive-by compromise technique page covers the delivery method.

The CVE record lists six Apple products with a fix in each. Apple released all of them on 13 May 2024 and publishes the fix in six security notes on support.apple.com. The table gives the affected range from the record and the fixed release from Apple's note.

NVD adds two further product groups to its configuration. It lists WebKitGTK and WPE WebKit before 2.44.2, and Fedora 39 and 40, as affected. These come from downstream vendors, not from Apple, so check their own advisories for the fixed builds.

The Apple notes list Safari 17.5 for macOS Monterey and macOS Ventura, while macOS Sonoma 14.5 has its own fix. We recommend moving every device to the newest release Apple still offers for it, not only to the May 2024 builds. Our vulnerability management guide covers how to track a rollout like this.