CVE-2024-27834: an Apple flaw fixed in 2024 is now confirmed as exploited

What the flaw does

CVE-2024-27834 is a bypass of Pointer Authenticationa protection built into Apple chips that signs memory addresses, so that a program notices when an attacker tampers with them. Apple's description in the CVE record is short: "An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication."

That condition matters. The bug is not a way in by itself. An attacker first needs another flaw that gives them arbitrary read and writethe ability to read and change any part of a program's memory, usually through a browser bug. Pointer Authentication is what normally stops them from turning that access into control of the device, and this flaw removes that barrier. In practice, bypasses like this are used as one link in a chain of exploits.

CISA added a CVSS 3.1 score of 5.5 to the record. The vector, AV:L/AC:L/PR:L/UI:N, reflects that the attacker needs to be running code on the device already.

Why it shows up now

The CVE was published on May 13, 2024. CISA adds a flaw to its catalog when it has evidence of exploitation, which can come long after the fix. CISA's entry does not say when the attacks happened or who carried them out, and Apple's description in the CVE record does not mention exploitation. So the confirmed facts are the fix date and the November 4, 2026 listing, nothing more.

What to do

On an iPhone or iPad, open Settings > General > Software Update and install what is offered. On a Mac, open System Settings > General > Software Update. Any device that has updated since May 2024 to Safari 17.5, iOS or iPadOS 16.7.8 or 17.5, macOS Sonoma 14.5, tvOS 17.5 or watchOS 10.5, or to anything newer, has the fix.

The devices to worry about are the ones that stopped updating, such as an old iPad kept in a drawer or office Macs held on an old macOS version. US federal civilian agencies have until November 18, 2026 to deal with it.

Android owners can run the same kind of check with our guide on how to find the Android security patch level. For a flaw that is being exploited on corporate networks right now, see our analysis of the Ivanti Connect Secure attacks.