The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, added a medium-severity Apple security flaw to its Known Exploited Vulnerabilities catalog on Wednesday after reports of active exploitation. The issue, CVE-2024-27834, affects multiple Apple operating systems and was already fixed by Apple in May 2024.
Pointer authentication bypass in Apple software
CVE-2024-27834 carries a CVSS score of 5.5 and is an improper authentication flaw. It could let an attacker with arbitrary read and write capability bypass Pointer Authentication. Apple addressed it with improved checks in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. The vulnerability was shown as a zero-day at the Pwn2Own Vancouver hacking contest in March 2024.
Reported exploitation tied to malware delivery
CISA’s addition follows a report from Sekoia that threat actors possibly linked to Russia used previously patched flaws in Safari and Google Chrome to deliver malware that can harvest browser and device data. The activity has been attributed to APT29, also known as Cozy Bear and Midnight Blizzard, with moderate to high confidence. APT29 is described as a state-sponsored hacking group affiliated with Russia’s Foreign Intelligence Service.
The attacks use three initial access routes. Those routes are compromised legitimate websites, fake sites that pose as popular websites, and a supply chain attack aimed at Plerdy SEO Tracker. The malicious JavaScript then profiles the visitor’s device and triggers the vulnerability before the information-stealing payload is deployed.
Exploit chain and agency deadline
CISA says the zero-click exploit chain combines CVE-2025-43529, a remote code execution flaw in WebKit, and CVE-2025-43529, the pointer authentication codes bypass, to run a JavaScript payload built for browser cookie theft. Federal Civilian Executive Branch agencies are recommended to apply the necessary patches by November 18, 2026.
Licensed under CC BY-ND 4.0 International