CVE-2024-27834: Apple WebKit PAC Bypass

Are You Affected?

CVE-2024-27834 is an Apple WebKit improper-authentication vulnerability. It is not described as a standalone unauthenticated remote compromise. The published threat model requires local access, low privileges, and existing arbitrary read/write capability.

In practice, the flaw is most relevant as an exploit-chain hardening bypass. An attacker who has already obtained powerful memory-access primitives may use it to defeat Pointer Authentication protections.

Organizations managing Apple devices should also review their least-privilege practices and endpoint inventory to identify systems where a low-privilege foothold could be especially damaging.

Affected and Fixed Versions

“Earlier than” should be interpreted against the relevant release branch. Use Apple’s update mechanism and vendor advisory information rather than relying only on product-name matching.

Linux distributions may backport the fix without using an upstream version that visibly compares as 2.44.2 or later. Verify the distribution security advisory and installed package revision. Do not mark an asset vulnerable solely because its package string differs from the upstream WebKit version.

Analyst’s Take: Patch status should drive the first response, not the Medium NVD score. KEV confirms exploitation, while the vulnerability’s role in an exploit chain means teams should also investigate systems where arbitrary read/write capability or suspicious local execution was observed.

The Fix, If You’re in a Hurry

Install the fixed Apple release for each affected device:

• Safari 17.5
• iOS 16.7.8 or iOS 17.5
• iPadOS 16.7.8 or iPadOS 17.5
• macOS Sonoma 14.5
• tvOS 17.5
• watchOS 10.5

For WebKitGTK and WPE WebKit, install version 2.44.2 or later where the upstream version scheme applies. On Debian, Ubuntu, Fedora, Red Hat, SUSE, and other distributions, use the distribution’s security package instead of forcing an upstream build. A vendor backport may contain the correction while retaining an older-looking package version.

On macOS, administrators can inventory the operating-system version and use the organization’s approved software-update workflow:

sw_vers -productVersion
softwareupdate --list
sudo softwareupdate --install --all

These commands do not prove that a particular CVE is remediated. After installation, verify the resulting OS or Safari version against the applicable Apple advisory. For managed Apple fleets, enforce the update through the organization’s MDM platform and record compliance by device and release branch.

For Linux systems using WebKitGTK, a generic package workflow might look like this:

# Debian/Ubuntu example
sudo apt update
sudo apt install --only-upgrade libwebkit2gtk-4.1-0 libwebkit2gtk-4.0-37

# Confirm installed package versions
dpkg-query -W -f='${Package} ${Version}\n' \
  libwebkit2gtk-4.1-0 libwebkit2gtk-4.0-37 2>/dev/null

Treat these commands as examples, not universal remediation procedures. If a fixed package is unavailable, follow vendor mitigations and consider discontinuing use of the affected product where mitigations are unavailable. Restricting WebKit-based applications, isolating affected systems, and prioritizing exposed or high-value devices can reduce risk temporarily, but these measures do not replace the update.

How This Vulnerability Works

Pointer Authentication, commonly abbreviated PAC, is a hardware-assisted protection used on supported Arm-based systems. It adds cryptographic authentication information to pointers so that certain corrupted or forged pointers can be detected before use.

PAC is not a complete memory-safety boundary, but it raises the difficulty of turning a memory-corruption primitive into reliable code execution.

CVE-2024-27834 is described as an improper-authentication issue in WebKit. Apple’s advisory states that the issue was addressed with improved checks and that an attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

The practical implication is that an attacker does not begin with only an ordinary browser request and immediately obtain the capability described. The attacker already has a powerful primitive and uses the flaw to weaken a downstream exploit defense.

The supplied public records do not establish all implementation details needed to reproduce the bypass. Apple associates the issue with WebKit Bugzilla issue 272750 and credits Manfred Paul, working with Trend Micro’s Zero Day Initiative.

Defenders should avoid assuming that the flaw is an ordinary remote WebKit memory-corruption vulnerability or that every browser visit is sufficient for exploitation.

Technical Notes

The important exploit-chain sequence is:

1. An attacker obtains local access and low privileges.
2. A separate vulnerability or compromise supplies arbitrary read and write capability.
3. The attacker abuses the WebKit authentication weakness to bypass Pointer Authentication checks.
4. The attacker may then have a more reliable path to alter protected control data or continue an exploit chain.

This sequence explains why the CVSS attack vector is local and why the vulnerability still matters to incident responders. Evidence of an earlier compromise may be more valuable than searching for a distinctive network request to CVE-2024-27834 itself.

Severity Explained

NVD assigns CVE-2024-27834 a CVSS v3.1 score of 5.5, rated Medium. Its vector is:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

The components mean:

• AV:L, Local: Exploitation requires local access to the affected system rather than a direct network path.
• AC:L, Low: Once prerequisites are present, the additional attack complexity is considered low.
• PR:L, Low: The attacker requires low privileges.
• UI:N, None: No separate victim interaction is required.
• S:U, Unchanged: The impact remains within the vulnerable security authority.
• C:N, None: The scored impact does not directly claim loss of confidentiality.
• I:H, High: Successful exploitation can have a high impact on integrity.
• A:N, None: The CVSS score does not claim a direct availability impact.

The score should not be read in isolation. The vector captures the stated vulnerability conditions, but it does not fully represent the operational importance of bypassing a defense designed to contain memory-corruption exploitation.

CISA’s KEV inclusion is the stronger urgency signal for patch prioritization. It indicates confirmed exploitation in the wild even though the NVD rating is Medium.

Organizations should distinguish between the vulnerability’s direct score and the risk of a complete exploit chain. A low-privilege foothold combined with a separate arbitrary read/write vulnerability may turn this bypass into a meaningful escalation or persistence step. Asset value, device exposure, exploit-chain evidence, and sensitive-data access should influence prioritization.

Is CVE-2024-27834 Being Exploited?

Yes. CISA added CVE-2024-27834 to the Known Exploited Vulnerabilities catalog on November 4, 2026, with a federal remediation deadline of November 18, 2026.

KEV inclusion confirms that the vulnerability has been exploited in the wild. It is not merely a prediction based on severity or exploitability scoring.

CISA currently marks use in a known ransomware campaign as Unknown. Defenders should not claim that ransomware operators are using this vulnerability, but they should also not treat the absence of ransomware attribution as evidence of safety. The available information establishes exploitation, not the identity of every actor, campaign, or intrusion set involved.

The supplied record does not identify a verified, CVE-specific public GitHub proof of concept. Generic search results, unrelated WebKit repositories, and discussions of Pointer Authentication should not be treated as proof that a public exploit exists for this CVE.

The absence of a confirmed public PoC does not reduce the need to patch because exploitation is already confirmed through KEV.