Vulnerability · CVE-2024-27834
Pointer authentication, added two years after the CVE number.
KEV is sorted by the day CISA accepted evidence, not by the year in the identifier. This one was added on 4 November 2026. Federal due date 18 November.
Why the number looks old
People sort "new" by the CVE year and then miss the row. CVE-2024-27834 entered the catalog on 4 November 2026, in the same week as the SonicWall and WordPress additions. The alert that day calls it improper authentication in Apple's multiple products.
The public description of the bug is specific about the precondition: an attacker who already has arbitrary read and write can bypass pointer authentication. That is a second lock on a chain, not a document you open. If your briefing says "a website visit is enough," it is describing a different bug.
Products named in the public summary
iOS, iPadOS, macOS, Safari, tvOS, and watchOS 10.5 are the names carried with the catalog summary we used. Apple's security updates are the list that matters for a given device, because a watch and a laptop do not share a build. This page does not invent a marketing version and call it the fix.
What the precondition changes about triage
There is no forensic-triage flag on this row in the mirror of catalog 2026.11.06. The precondition still changes the hunt. You are not looking for a lone crash from a browser. You are looking for a memory-corruption bug, in the same week, that would have given the read and write this bypass needs. Patch the listed systems anyway: chains are how a "second lock" shows up in KEV. Do not wait for a write-up of pointer authentication. We are not publishing one.
Close condition
Every device family you actually issue is on the security update Apple lists for this CVE, and the 18 November date is on the change ticket rather than in a slide. Devices you do not manage are not your row.