CISA Adds Actively Exploited Apple PAC Bypass CVE-2024-27834 to KEV Catalog
CISA added CVE-2024-27834 (CVSS 5.5), an Apple iOS/iPadOS/Safari flaw, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. The vulnerability allows an attacker who already has arbitrary read/write memory access to bypass Pointer Authentication (PAC), a hardware-based mitigation on Apple silicon that cryptographically signs control-flow pointers to prevent memory-corruption exploitation. Researchers at Sekoia linked exploitation with moderate-to-high confidence to the Russia-linked espionage group APT29, who used compromised and fake websites plus a supply-chain compromise of the Plerdy SEO Tracker to deliver malicious JavaScript in a zero-click exploit chain targeting Safari and Chrome to deploy information-stealing malware that collects browser cookies and device data.
Entenda a falha
A vulnerabilidade
CVE-2024-27834 (CVSS 5.5) is a Pointer Authentication (PAC) bypass in Apple's operating systems and Safari. To use it, an attacker must already have arbitrary read/write access to memory, for example inside the browser renderer. In return they can forge valid signed pointers and move toward arbitrary code execution. The articles name iPadOS 16.7.8 and iPadOS 17.5 as the fixed releases. CISA added the flaw to the KEV catalog because it is exploited in the wild, and federal agencies must remediate by November 18, 2026.
Como funciona
On Apple silicon, control-flow pointers carry a cryptographic signature (PAC). If an attacker with read/write memory access overwrites a function pointer without a valid signature, the process crashes instead of running the attacker's code. In the reported attacks, malicious JavaScript delivered through web pages reaches the browser and gains read/write inside the renderer. The exploit chain then uses CVE-2024-27834 to forge the valid pointers that PAC would normally reject. That step turns memory control into code execution.
Por que é vulnerável
The articles do not describe the precise root cause. They say only that Apple fixed it with improved security checks, which implies the protection could be circumvented because of missing or insufficient checks. Pointer Authentication exists to stop memory-corruption attacks, so a bypass weakens that barrier and makes other bugs easier to exploit.
Como foi descoberta
The articles do not say who found the flaw or when it was reported to Apple. Sekoia reported attacks, attributed with moderate to high confidence to the Russia-linked group APT29, that used compromised and fake websites and a supply-chain compromise of Plerdy SEO Tracker to deliver malicious JavaScript. Sekoia identified CVE-2024-27834 as the PAC bypass in the chain, and CISA then added it to KEV after confirming exploitation.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
Sekoia describes a zero-click exploit chain for Safari and Chrome that incorporates a PAC bypass using CVE-2024-27834 and deploys information-stealing malware that collects browser cookies and device data. It was seen in real attacks, so a working exploit exists. The articles mention no published copy, so it counts as private. Because it is actively exploited, patching Apple devices is urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 08:18.
Detalhes técnicos
CVE-2024-27834 enables a PAC bypass, which is necessary for full code execution on modern Apple silicon since simply overwriting a function pointer without a valid signature will crash the process rather than execute attacker-controlled code. Apple fixed the issue via improved security checks in iPadOS 16.7.8 and iPadOS 17.5.
Remediação
Under Binding Operational Directive (BOD) 22-01, FCEB agencies must remediate CVE-2024-27834 by November 18, 2026. CISA and the article's author recommend that private organizations also review the KEV catalog and patch affected Apple devices promptly.
Linha do tempo
-
CISA Adds Actively Exploited Apple PAC Bypass CVE-2024-27834 to KEV Catalog
ler a análise desta fonte ocultar
CISA added CVE-2024-27834 (CVSS 5.5), an Apple iOS/iPadOS/Safari flaw, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. The vulnerability allows an attacker who already has arbitrary read/write memory access to bypass Pointer Authentication (PAC), a hardware-based mitigation on Apple silicon that cryptographically signs control-flow pointers to prevent memory-corruption exploitation. Researchers at Sekoia linked exploitation with moderate-to-high confidence to the Russia-linked espionage group APT29, who used compromised and fake websites plus a supply-chain compromise of the Plerdy SEO Tracker to deliver malicious JavaScript in a zero-click exploit chain targeting Safari and Chrome to deploy information-stealing malware that collects browser cookies and device data.
Technical Details
CVE-2024-27834 enables a PAC bypass, which is necessary for full code execution on modern Apple silicon since simply overwriting a function pointer without a valid signature will crash the process rather than execute attacker-controlled code. Apple fixed the issue via improved security checks in iPadOS 16.7.8 and iPadOS 17.5.
Remediation
Under Binding Operational Directive (BOD) 22-01, FCEB agencies must remediate CVE-2024-27834 by November 18, 2026. CISA and the article's author recommend that private organizations also review the KEV catalog and patch affected Apple devices promptly.