# CVE-2024-27834: A Apple (several products) bug is being used in attacks

Status: Being used now (CISA KEV, added 2026-11-04)
Who: 
Do this: 
Fixed in: Safari 17.5; iOS 16.7.8 and iPadOS 16.7.8; tvOS 17.5; watchOS 10.5; macOS Sonoma 14.5; iOS 17.5 and iPadOS 17.5
If a device runs a newer major version than these, the vendor has not named it for this bug: make sure it has the latest update.

## Before you update
Updates restart the device. On a computer that runs a service or sits unattended, plan the restart: an encrypted disk (FileVault, BitLocker) can stop at an unlock screen until someone signs in, and the service stays down until then. Phones and tablets: update them by hand, they are often the highest-risk devices.

## Agent prompt (read-only)
Read-only check, change nothing, send nothing anywhere.
Is Apple Multiple Products (CVE-2024-27834) installed or running on this machine or anywhere I manage?
Fixed in (from the vendor's advisories): Safari 17.5; iOS 16.7.8 and iPadOS 16.7.8; tvOS 17.5; watchOS 10.5; macOS Sonoma 14.5; iOS 17.5 and iPadOS 17.5.
1. Find every device that runs this system: this computer, other computers you can reach, virtual machines (UTM, Parallels, VMware, Tart), installer apps and disk images, phone and tablet simulators, and phones and tablets. Record each version.
2. Compare each version against the fixed version for CVE-2024-27834. Quote the vendor page you used. If a device is on a newer major version than any listed, the vendor hasn't named it for this bug: mark it 'not listed by vendor' and check that it has the latest update.
3. Report a table: where, version, fixed version, status (exposed / fixed / not installed / not listed by vendor / unsure).
4. List every device or system you could not check (phones, tablets, other people's machines) and how the owner checks it by hand. Put the highest-risk ones first.
5. List the exact update steps, but do not run them. Flag any machine that runs a service or has no one at the keyboard: an update reboot can stop at a disk-unlock screen (FileVault, BitLocker) and keep the service down until someone signs in.

## Official description
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.

## Sources
- https://support.apple.com/en-us/120896 (Safari 17.5)
- https://support.apple.com/en-us/120898 (iOS 16.7.8 and iPadOS 16.7.8)
- https://support.apple.com/en-us/120901 (tvOS 17.5)
- https://support.apple.com/en-us/120902 (watchOS 10.5)
- https://support.apple.com/en-us/120903 (macOS Sonoma 14.5)
- https://support.apple.com/en-us/120905 (iOS 17.5 and iPadOS 17.5)
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2024-27834

Generated by isitexploited.org from public sources. Verify version numbers against the vendor before acting.