CISA Adds Exploited Apple Flaw CVE-2024-27834 to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2024-27834, a medium-severity Apple vulnerability, to its Known Exploited Vulnerabilities catalog following reports of active exploitation. The flaw can allow an attacker with arbitrary read and write capability to bypass Pointer Authentication, and it was addressed by Apple in May 2024. Federal Civilian Executive Branch agencies are recommended to apply the necessary patches by November 18, 2026.

Vulnerability Details

CVE-2024-27834 is described as improper authentication with a CVSS score of 5.5. Apple addressed it with improved checks in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. The vulnerability was demonstrated as a zero-day at the Pwn2Own Vancouver hacking contest held in March 2024.

Attribution and Attack Paths

Sekoia reported that threat actors possibly linked to Russia exploited previously patched vulnerabilities in Safari and Google Chrome to deliver malware capable of harvesting browser and device data. The activity was attributed to APT29, also known as Cozy Bear and Midnight Blizzard, a state-sponsored hacking group affiliated with Russia's Foreign Intelligence Service, with moderate to high confidence. Attacks used three initial access pathways: compromised legitimate websites, fake sites masquerading as popular websites, and a supply chain attack aimed at Plerdy SEO Tracker.

Exploit Chain and Payload

The malicious JavaScript triggers the vulnerability and ultimately deploys an information-stealing payload after profiling the visitor's device. The zero-click exploit chain combines CVE-2025-43529, a remote code execution flaw in WebKit, and a pointer authentication codes bypass to execute a JavaScript payload designed for browser cookie theft.

Sources: The Hacker News