Federal civilian agencies have three weeks to patch an iPhone flaw Apple fixed back in May 2024. The US cyber agency moved it onto the exploited-in-the-wild list on Wednesday, sixteen months after the wrong people started using it.
A contest demo that became a weapon
CVE-2024-27834 is an authentication failure in Apple’s memory protections. Anyone holding read and write access can use it to defeat Pointer Authentication, the hardware guard that blocks an attacker from redirecting a program to code of their choosing. Researchers showed it off as a zero-day at Pwn2Own Vancouver in March 2024; Apple shipped checks in iOS 17.5, macOS Sonoma 14.5 and the contemporaneous tvOS, watchOS and Safari releases.
The 5.5 score understates it. Alone, the bug grants nothing. Chained behind a memory corruption flaw it converts a crash into a working exploit, which is how it surfaced in Sekoia’s Poisoned Source campaign.
Why the catalog entry matters
The trigger was Sekoia’s November 4 disclosure tying a watering hole operation to APT29, the SVR-linked group also tracked as Midnight Blizzard. One package served to visitors on iOS 16.7 paired this bypass with CVE-2025-43529, a WebKit remote code execution bug, and used the pair to pull Safari cookies off the device.
Agencies must close the gap by November 18, 2026. The deadline is administrative rather than technical – the fix has existed for eighteen months, and hardware that never received iOS 17.5 has not got it at all.
The real lesson is inventory
Macs and iPhones escape patching discipline more often than enterprise laptops do, and a bypass stays useful as long as any link, ad frame or compromised analytics tag can still deliver the first stage. A device that cannot install iOS 17.5 or later is the exposure, and no configuration change closes it.
