Apple security release · May 2024
Apple iOS 16.7.8 & 17.5: CVE-2024-27834
Apple fixed CVE-2024-27834 in iOS/iPadOS 16.7.8 for older listed models and 17.5 for newer models.
1
WebKit CVE covered
R/W
Existing capability required
16.7.8 / 17.5
iOS/iPadOS fix releases
What Apple’s advisory confirms
Apple lists CVE-2024-27834 in the iOS 17.5 and iPadOS 17.5 security content. Its stated impact is that an attacker who already has arbitrary read and write capability may be able to bypass Pointer Authentication (PAC); Apple says the issue was fixed with improved checks. The advisory does not say that a webpage alone provides that read/write capability, and it does not report in-the-wild exploitation. Install a supported fixed release across managed Apple devices. Apple also lists this fix in iOS 16.7.8 and iPadOS 16.7.8 for iPhone 8, 8 Plus and X, iPad (5th generation), 9.7-inch iPad Pro, and 12.9-inch iPad Pro (1st generation). The iOS 17.5 advisory covers iPhone XS and later and the listed newer iPads.
CVE-2024-27834 remediation details
| CVE | Component | Documented impact | Prerequisite | Fix |
|---|---|---|---|---|
CVE-2024-27834 | WebKit | Pointer Authentication bypass | Attacker already has arbitrary read and write capability | Update older listed devices to iOS/iPadOS 16.7.8; iPhone XS and later and the listed newer iPads are covered by 17.5. Apple also lists fixes in Safari 17.5, macOS Sonoma 14.5, tvOS 17.5, and watchOS 10.5. Install a currently supported release. |
SOURCE ADVISORY
Apple’s original iOS 17.5 security advisory →
Check Apple’s affected-product list and update guidance for CVE-2024-27834.