CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on Wednesday. The bug is two and a half years old. Apple fixed it in May 2024.
NVD describes it as a Pointer Authentication bypass: an attacker who already has arbitrary read and write capability can get around PAC. The fix shipped in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5. The base score is 5.5, MEDIUM, AV:L/PR:L, local and low privileges. Apple’s Safari 17.5 note credits Manfred Paul working with Trend Micro’s Zero Day Initiative. Per The Hacker News, it was demonstrated as a zero-day at Pwn2Own Vancouver in March 2024.
Medium. Sure. A 5.5 on a bug that is the second half of a chain is a number that tells you nothing, which is what I said about CVE scoring inflation from the other direction. PAC is a mitigation, not a vulnerability class. Its job is to make a memory corruption bug harder to turn into code execution. Defeat it and the first-stage bug you were told was merely annoying becomes the whole game. Nobody exploits a PAC bypass alone; it’s a component, and the CVSS vector can’t see the rest of the chain.
The chain is where the news is. The Hacker News relays a Sekoia report attributing activity “with moderate to high confidence” to APT29 (Cozy Bear, Midnight Blizzard). Three entry routes: compromised legitimate sites, fake sites imitating popular ones, and a supply chain attack on Plerdy SEO Tracker. Each serves JavaScript that profiles the visitor’s device, then triggers the bug and drops an information stealer aimed at browser cookies. I’m relaying a vendor report through a news article. I haven’t read Sekoia’s writeup, so treat the attribution as theirs, not mine.
One loose end: the article names CVE-2025-43529 twice, once as the WebKit remote code execution flaw and once as the PAC bypass. That’s a typo somewhere, and I’m not going to guess which ID goes where. The PAC bypass in the KEV entry is CVE-2024-27834.
Federal civilian agencies have until November 18, 2026 to patch. You don’t get a deadline, which is worse, because nobody will ask.
What matters here:
- Old patched bugs are the product. The exploit works against devices that missed a May 2024 update. Not a zero-day, just a patch backlog with a threat actor’s name on it.
- Check the stragglers. Apple’s own list includes iOS 16.7.8 for the iPhone 8 and iPhone X era hardware. Those phones live in drawers and on kiosk stands. Find them.
- The web is the delivery system. A compromised analytics-style plugin is enough. This is the same shape as the package registry typosquat wave: you trusted a dependency, and it was somebody else’s.
I’ll give Apple this much: PAC did its job for two years. It raised the cost of exploitation until somebody with a state budget paid it. That’s all a mitigation promises. The kernel and security hub has more on why defense in depth keeps being a ladder rather than a wall.
Update the thing, then go look for the one you forgot.