Safari pointer auth bypass, exploited in the wild (CVE-2024-27834)

Actively exploited in the wild - CVE-2024-27834 is a medium-severity pointer authentication bypass in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5, macOS Sonoma 14.5, tvOS 17.5, and watchOS 10.5 that lets an attacker who already holds arbitrary read and write capability defeat pointer authentication and redirect control flow inside a process. Apple has shipped fixes across all affected platforms; update now.

Overview

Pointer Authentication (PAC) is a hardware-backed defense on Apple silicon and ARM chips that signs function pointers so that an attacker who corrupts memory cannot simply overwrite a return address and jump anywhere. CVE-2024-27834 is a weakness in how that check is applied: Apple addressed the issue with improved checks that close the gap. In practical terms, a threat actor who already has read and write access to a process’s memory can now bypass the PAC guarantee and use the freed control-flow primitive to execute code.

This is a second-stage vulnerability. It does not grant an attacker read and write access on its own; it removes the PAC barrier that normally slows an attacker down after they have already achieved memory corruption. That pairing is what makes it valuable in a chained exploit, and it is why Apple’s language references an attacker with arbitrary read and write capability.

Impact

Successful exploitation breaks a core mitigation in Safari’s WebContent process and in the affected operating systems, allowing an attacker to turn a memory corruption bug into reliable arbitrary code execution that survives PAC enforcement. On iOS and iPadOS, that can mean bypassing browser sandbox assumptions; on macOS Sonoma, it weakens hardened runtime protections for signed processes. The CVSS score of 5.5 (LOCAL, LOW complexity, LOW privileges, no user interaction) reflects that the attacker needs an existing foothold, not that the consequence is minor.

Remediation and Mitigation

• Update to Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, or watchOS 10.5, whichever applies to the device.
• Prioritize internet-facing and user-facing devices first: iPhones, iPads, and Macs running Safari.
• Because exploitation requires a prior memory-corruption primitive, harden the surrounding attack surface: keep WebKit and the OS patched, avoid untrusted links in Safari, and restrict Lockdown Mode for high-risk users.
• Track CISA KEV status and confirm fleet coverage, since the issue is confirmed exploited.

Security Insight

CVE-2024-27834 fits a familiar Apple pattern: the headline fix is a PAC hardening adjustment, but the real story is that the mitigation attackers most rely on bypassing keeps needing bypass fixes of its own. It echoes the long line of WebKit zero-days that Apple patches quietly and in parallel across every OS, as seen in Apple fixes iOS CoreGraphics zero-day CVE-2026-86950, where the same cross-platform rollout discipline applies. An EPSS score of 0.6% correctly signals that mass exploitation is unlikely, but KEV listing means chained, targeted attacks are real, and the patch cadence, not the score, is what protects defenders. Related reading: iOS Bug Let FBI Recover Deleted Signal Messages and LangChain, LangGraph Flaws Expose Files, Secrets.

Further Reading

• Apple fixes iOS CoreGraphics zero-day CVE-2026-86950
• iOS Bug Let FBI Recover Deleted Signal Messages
• LangChain, LangGraph Flaws Expose Files, Secrets,
• All Medium Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs