CVE-2024-27834 lets attackers bypass Apple's Pointer Authentication. CISA added it to its KEV list on Nov 4, 2026. Affected versions and update steps inside.
If you run an iPhone, Mac, Apple TV, Apple Watch or a device with Safari, this one is on your list. CVE-2024-27834 was fixed by Apple in May 2024, but CISA only added it to its catalog of actively exploited vulnerabilities on November 4, 2026. The flaw is old, but evidence of exploitation came up recently.
Short answer: CVE-2024-27834 is an improper authentication flaw in Apple’s iOS, iPadOS, macOS, Safari, tvOS and watchOS that lets an attacker bypass Pointer Authentication. CISA added it to the KEV catalog on November 4, 2026, with a remediation deadline of November 18, 2026. Apple fixed it in Safari 17.5, iOS and iPadOS 17.5 and 16.7.8, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5. If you run an older version of any of these, update it.
What happened?
Pointer Authentication (PAC) is a hardware protection on Apple devices. It adds a cryptographic signature to pointers, the memory addresses a program uses. If the signature does not match, the system refuses to use that pointer. The goal is to make it harder for an attacker to redirect a program’s control flow.
CVE-2024-27834 is a flaw that allows that protection to be bypassed. NVD classifies the weakness as CWE-287 (Improper Authentication). Apple fixed it by adding improved checks.
CISA added the flaw to KEV on November 4, 2026. The NVD record shows it was published on May 14, 2024, and Apple’s security notes show the fixes were released on May 13, 2024. Systems on the fixed versions are not affected. The risk is on devices still running older releases.
NVD’s description says an attacker with “arbitrary read and write capability” may be able to bypass Pointer Authentication. That means NVD assumes the attacker already has arbitrary read and write access, so the bypass is not described as an entry point on its own. This reading comes only from the NVD text. The sources do not describe the exploit chain it was used in.
Who is affected?
| Attribute | Details |
|---|---|
| CVE ID | CVE-2024-27834 |
| Product | Apple Multiple Products (iOS, iPadOS, macOS, Safari, tvOS, watchOS) |
| CVSS | 5.5 (CVSS 3.1), severity: Medium |
| CVSS vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| Weakness type | CWE-287 (Improper Authentication) |
| NVD published | May 14, 2024 |
| Apple fix released | May 13, 2024 |
| Added to CISA KEV | November 4, 2026 |
| CISA due date | November 18, 2026 |
| Known ransomware use | Unknown (KEV entry says “Unknown”) |
| Affected versions | Any version earlier than the fixed versions listed below |
| Fixed versions | Safari 17.5 (for macOS Monterey and Ventura); iOS 17.5 and iPadOS 17.5; iOS 16.7.8 and iPadOS 16.7.8; macOS Sonoma 14.5; tvOS 17.5; watchOS 10.5 |
I could not pull exact affected version ranges from NVD’s CPE data, so the affected row describes the versions before the fixes rather than a precise range. Check Apple’s security notes for exact ranges.
The CVSS score of 5.5 is medium. The flaw is in the KEV catalog, though, which means CISA has evidence it has been exploited. That should move it up your patch list. A CVSS score alone is not a measure of risk.
What should you do?
- Check your device version. On iPhone and iPad, go to Settings > General > Software Update. On a Mac, open Terminal and run
sw_vers -productVersion, then compare the result with the table. For Safari, open Safari > About Safari. - If your version is lower than the fixed version in the table, you are affected. Update the device right away. After the update, check the version again.
- There is no workaround in our sources. The safest path is to update. The KEV entry says to follow vendor instructions and, if mitigations are unavailable, to consider discontinuing use of the product.
- If something looks wrong on the device. Back up important data and talk to someone who can investigate. The KEV entry marks forensic triage as “No,” but that does not mean the device is clean.
Frequently asked questions
Does this affect me?
Yes, if the operating system or Safari version on your Apple device is older than the fixed version in the table. You can check it in Settings or with sw_vers.
The CVSS is 5.5. Does it still matter?
It does. CVSS measures severity in isolation, not real-world risk. This flaw is in CISA’s list of actively exploited vulnerabilities, so it should be prioritized.
What if I cannot update right away?
Our sources do not list a workaround. Plan the update as soon as you can. The KEV entry sets the CISA due date at November 18, 2026.
Sources
- CISA Known Exploited Vulnerabilities Catalog
- Apple: Safari 17.5 security content
- Apple: iOS 16.7.8 and iPadOS 16.7.8 security content
- Apple: tvOS 17.5 security content
- Apple: watchOS 10.5 security content
- Apple: macOS Sonoma 14.5 security content
- Apple: iOS 17.5 and iPadOS 17.5 security content
This article was prepared on November 6, 2026, based on CISA and NVD records. It will be updated if new information appears. For server and application updates and ongoing security maintenance, get in touch via the quote form.