Urgent · CISA added an Apple WebKit flaw to its exploited-vulnerabilities catalog; Apple issued fixes in 2024.

CISA added CVE-2024-27834 on November 4. Apple says an attacker who already has arbitrary read and write capability may bypass Pointer Authentication. CISA's listing establishes exploitation evidence; it does not mean Apple has released a new patch today.

Apple addressed the flaw in iOS and iPadOS 17.5 and 16.7.8, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5 and watchOS 10.5. The iOS 16.7.8 branch covers iPhone 8, 8 Plus and X and certain older iPads; 17.5 covers iPhone XS and later and eligible iPads. Mac Safari 17.5 applies to Monterey and Ventura; Sonoma has its own fix. Choose the latest update available for the particular device and branch.

Apple advisories: https://support.apple.com/en-us/120905 ; https://support.apple.com/en-us/120898 ; https://support.apple.com/en-us/120903 ; https://support.apple.com/en-us/120896 . CISA: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

We did not independently assess update regressions, and no update can be certified universally safe.