, front page
InitialReach
How we report

SecurityApple WebKit, CVE-2024-27834Changed

CISA lists a flaw in Apple's WebKit, fixed in May 2024, as exploited in attacks

The US Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in WebKit, the engine Apple's Safari browser uses to display web pages, to its catalog of vulnerabilities known to be exploited on 4 November, "based on evidence of active exploitation". Apple fixed the flaw on 13 May 2024, and its security notes for those updates do not say it had been exploited.

The flaw, CVE-2024-27834, could let an attacker who is already able to read and write a device's memory at will get past Pointer Authentication, a protection in Apple's software, Apple says. Apple fixed it in Safari 17.5, iOS 17.5 and iPadOS 17.5, iOS 16.7.8 and iPadOS 16.7.8 for older iPhones and iPads, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5.

CISA's catalog gives US federal civilian agencies a due date of 18 November and does not mark a check for signs of compromise as required. Under the directive the catalog points to, how fast an agency has to act on a given system depends on that system, among other things on whether it can be reached from the internet.

Apple's WebKit flaw CVE-2024-27834 in CISA's catalog of exploited vulnerabilities

Before: Not listedNow: Listed on 4 November

What changed

Before CISA Known Exploited Vulnerabilities catalog, version 2026.11.03 (Internet Archive copy of 4 November), 3 November 2026Now CISA Adds One Known Exploited Vulnerability to Catalog, 4 November 2026

  1. In CISA's Known Exploited Vulnerabilities catalog

    Before

    Not listed (catalog of 3 November, 1,767 entries)

    Now

    Listed on 4 November (1,768 entries)

  2. Exploitation

    Before

    Not mentioned in Apple's security notes for the May 2024 updates; CISA's assessment in the flaw's CVE record, dated 16 May 2024, gave exploitation as none

    Now

    CISA cites evidence of active exploitation, and its assessment in the CVE record, updated on 4 November, gives exploitation as active; the EU Vulnerability Database marks it exploited since 4 November

  3. CISA's assessment of the flaw in its CVE record

    Before

    16 May 2024: exploitation none, can be automated, total technical impact; severity score 8.1 out of 10

    Now

    4 November 2026: exploitation active, cannot be automated, partial technical impact; severity score 5.5 out of 10

  4. Due date in CISA's catalog for US federal civilian agencies

    Before

    None

    Now

    18 November, with a check for signs of compromise not marked as required

What stayed the same

  • The fixes: Safari 17.5, iOS 17.5 and iPadOS 17.5, iOS 16.7.8 and iPadOS 16.7.8, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5, all released on 13 May 2024.
  • Apple's six security notes for those updates still do not say this flaw was exploited (read on 5 November).

What we don't know yet

  • Who is exploiting the flaw, against whom, and since when. CISA does not say what its evidence is, and Apple has said nothing new.
  • Whether it has been used in ransomware attacks. CISA's catalog marks this as unknown.
  • How the attacker gets the ability to read and write memory that the flaw requires: Apple's notes describe only this step.

The documents

For people in the field Identifiers, citations and the trade's shorthand, from the documents
Identifiers
CVE-2024-27834, EUVD-2024-25027. WebKit Bugzilla 272750. CISA's catalog names it 'Apple Multiple Products Improper Authentication Vulnerability' (CWE-287). Reported by Manfred Paul (@_manfp) working with Trend Micro's Zero Day Initiative, Apple's notes say. CVSS 3.1 base 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, from CISA's entry in the CVE record since 4 November; until then CISA's entry gave 8.1, AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
Fixed versions
Per the CVE record's affected ranges and Apple's notes: Safari 17.5 (for macOS Monterey and Ventura), iOS 17.5 and iPadOS 17.5, iOS 16.7.8 and iPadOS 16.7.8 (iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch and iPad Pro 12.9-inch 1st generation), macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, all released 13 May 2024. Apple's iOS 16.7.8 note lists this flaw as an entry added on 10 June 2024.
Federal deadline
The catalog's due date: 18 November 2026, two weeks after the listing; forensic triage marked No; known ransomware campaign use unknown. Under Binding Operational Directive 26-04, which the catalog's notes cite, each asset's remediation timeline depends on whether it is publicly exposed, its KEV status, whether exploitation can be automated and its technical impact. CISA's coordinator assessment in the CVE record, dated 4 November: exploitation active, not automatable, technical impact partial; its earlier assessment, dated 16 May 2024, said exploitation none, automatable yes, technical impact total.
Timeline
13 May 2024, Apple's updates and the CVE record published; 16 May 2024, CISA's first assessment in the CVE record; 10 June 2024, the flaw added to Apple's iOS 16.7.8 note; 4 November 2026, CISA's part of the CVE record rescored (13:29 UTC) and reassessed (17:36 and 20:14 UTC), the flaw listed in CISA's catalog (version 2026.11.04) and marked exploited in the EUVD; 5 November (UTC), the CVE, NVD and EUVD records updated.