medium Known exploitedREV. 01
CVE-2024-27834Apple Pointer Authentication Bypass
An attacker who already has arbitrary read and write capability may be able to bypass Pointer Authentication, a memory protection, on Apple devices. Safari, iOS, iPadOS, macOS, tvOS and watchOS are affected.
Read the risk
THE VITAL STATS- CVSS score
- 5.5/ 10 CVSS v3.1
- EPSS probability
- 0.6% Likelihood of exploitation
- Attack complexity
- Low Conditions needed to exploit
- Known exploited
- Yes — CISA KEV
- CVE published
- 2024-05-14
- Added to KEV
- 2026-11-04
- CISA due date
- 2026-11-18
- Exploit published
- Not recorded
- Confidence
- high
- Kill chain
- unclassified
- MITRE ATT&CK
- —
- Severity
- medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attacker needsArbitrary read and write capability on the target device.
Fixed inSafari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5
Behind the card
5 REFERENCES- 01CVE recordNVD recordnvd.nist.gov
- 02CISACISA Known Exploited Vulnerabilities catalogcisa.gov
- 03Vendor advisorysupport.apple.comsupport.apple.com
- 04Vendor advisorysupport.apple.comsupport.apple.com
- 05Vendor advisorysupport.apple.comsupport.apple.com
Field-level provenanceTRACE THE SOURCES +
Which source supports each field, when it was retrieved, and who extracted it.
| Fields | Source | Retrieved | Extractor | Confidence |
|---|---|---|---|---|
| cvss, exploitation.attack_complexity, exploitation.exploit_available, published_at, references | nvd.nist.gov | 2026-11-05 | scrty-crds-pipeline/0.1 | high |
| exploitation.known_exploited, exploitation.kev_added, exploitation.kev_due | cisa.gov | 2026-11-05 | scrty-crds-pipeline/0.1 | high |
| epss | api.first.org | 2026-11-05 | scrty-crds-pipeline/0.1 | high |
| title, subtitle, summary, severity, remediation, mitre_attack, kill_chain, recommended_action, confidence, tags, exploitation.prerequisites | nvd.nist.gov | 2026-11-05 | claude-code | high |
Printing history
THE RECORD- r1Initial base card
History unavailable — this build has no Git history for the card file.