Hackers Exploit Patched Apple Flaw to Deliver Info-Stea

What Happened

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-27834, a Safari pointer authentication bypass affecting multiple Apple operating systems, to its Known Exploited Vulnerabilities (KEV) catalog. The designation confirms that attackers have exploited the flaw in the wild to deliver information-stealing malware. Notably, the bug carries only a medium-severity CVSS rating, yet CISA’s KEV listing signals confirmed, active abuse rather than theoretical risk.

The flaw was originally addressed by Apple in a prior security update, meaning the vulnerable population is not those awaiting a fix but those who have not yet applied one. The KEV addition triggers binding operational directive requirements for U.S. federal civilian agencies to remediate within a set deadline, and serves as a broader signal to all enterprises running Apple hardware.

Why It Matters

Pointer authentication is a hardware-backed mitigation Apple introduced with its ARM64e architecture to make memory-corruption exploits significantly harder. A bypass of this mechanism erodes one of the platform’s core defenses, allowing memory-safety weaknesses that should have been contained to become weaponizable. Attackers abusing the flaw to deploy infostealers means the objective is credential and session-token theft, which frequently becomes the entry point for downstream account takeover and ransomware.

The medium severity score is the central problem. Many organizations triage patching by CVSS, and a medium rating on an Apple OS update often lands behind higher-scored items on the queue. CISA’s KEV action is a direct correction to that prioritization error.

Technical Details

CVE-2024-27834 is a pointer authentication bypass in Safari affecting iOS, iPadOS, and macOS. The attack vector is web-based: a victim lures into visiting a malicious or compromised page can have the pointer authentication protection defeated, opening the door to further exploitation and malware delivery. Because the vector is the browser rather than a standalone application, no user installation step is required beyond browsing.

Apple patched the issue in its operating system updates. The KEV listing indicates exploitation has been observed against unpatched devices in real campaigns tied to infostealer distribution. Yazoul’s detailed advisory on this CVE covers affected version ranges and fixed builds.

Immediate Risk

Any Apple device that has not received the relevant OS update since Apple’s fix remains exposed. Higher-risk populations include remote and mobile workforces, executives, and any user whose Safari session touches privileged SaaS or identity providers, since stolen session tokens can bypass MFA entirely. Federal agencies face a hard remediation deadline; private-sector organizations should treat the KEV listing as an equivalent priority signal.

Security Insight

The instructive parallel is CVE-2023-4863, the WebP library heap overflow that began as a browser image-parsing bug and cascaded across every application bundling libwebp. CVE-2024-27834 follows a quieter version of the same pattern: a platform-wide protection (pointer authentication) is only as strong as the least-patched device relying on it. The non-obvious takeaway is that medium-severity Apple OS updates should be treated as high-priority by default, because Apple’s severity scores do not account for the blast radius of a defense-in-depth bypass. Security teams that gate mobile OS patching on CVSS thresholds are systematically deprioritizing the exact class of bug attackers now favor. Track mobile OS compliance as a first-class metric, not an afterthought to desktop patch cycles.

Further Reading

• Safari pointer auth bypass, exploited in the wild (CVE-2024-27834)
• Latest Security News
• CVE Advisories
• Data Breach Reports