CVE-2024-27800 Overview
CVE-2024-27800 is a denial-of-service vulnerability affecting multiple Apple operating systems. Processing a maliciously crafted message can crash the vulnerable component, disrupting device availability. Apple addressed the issue by removing the vulnerable code across its product lines. The flaw is classified under [CWE-400] (Uncontrolled Resource Consumption) and requires user interaction over a network attack vector. Apple patched the vulnerability in iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2, and watchOS 10.5.
Critical Impact
A remote attacker can trigger a denial-of-service condition on unpatched Apple devices by delivering a crafted message, impacting device availability across iOS, macOS, watchOS, tvOS, and visionOS.
Affected Products
- Apple iOS and iPadOS (versions prior to 16.7.8 and 17.5)
- Apple macOS Monterey (prior to 12.7.5), Ventura (prior to 13.6.7), and Sonoma (prior to 14.5)
- Apple tvOS 17.5, visionOS 1.2, and watchOS 10.5 (prior versions)
Discovery Timeline
- 2024-06-10 - CVE-2024-27800 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-27800
Vulnerability Analysis
CVE-2024-27800 is a denial-of-service vulnerability triggered when an affected Apple operating system processes a maliciously crafted message. Apple's advisory states the issue was resolved by removing the vulnerable code entirely, indicating the affected functionality was neither essential nor safely repairable in place. The weakness maps to [CWE-400] Uncontrolled Resource Consumption, which typically occurs when input parsing consumes memory, CPU, or thread resources without adequate bounds. The vulnerability spans Apple's entire operating system portfolio, suggesting shared framework code responsible for message processing.
Root Cause
Apple has not published detailed root cause information beyond confirming the vulnerable code path was removed. The [CWE-400] classification points to insufficient validation or bounding of a resource-consuming operation during message handling. Because the fix removed the code rather than patching it, the affected feature was likely deprecated or replaced.
Attack Vector
Exploitation requires a remote attacker to deliver a crafted message that the target device processes. The CVSS vector indicates user interaction is required, meaning a victim must open, view, or otherwise trigger processing of the malicious payload. Successful exploitation impacts availability only, with no compromise of confidentiality or integrity. Refer to the Apple Support advisories for the specific components affected in each operating system.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-27800
Indicators of Compromise
- Unexpected application or system service crashes on Apple devices following receipt of a message from an untrusted source
- Repeated crash reports referencing message-processing frameworks in the device's diagnostic logs
- Devices running Apple operating system versions below the patched builds listed in the Apple Support articles
Detection Strategies
- Inventory Apple endpoints and correlate installed OS build numbers against the fixed versions to identify exposed devices
- Monitor endpoint telemetry for abnormal crash frequency in messaging or communication-related processes
- Review mobile device management (MDM) compliance reports for devices below the patched OS baseline
Monitoring Recommendations
- Enable OS crash log collection through MDM to detect repeated denial-of-service events
- Track vendor advisory feeds from Apple for updates and related CVEs sharing the same fix bundle
- Alert on Apple devices that fail to check in or reboot unexpectedly following inbound messages
How to Mitigate CVE-2024-27800
Immediate Actions Required
- Update all Apple devices to iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2, or watchOS 10.5 or later
- Prioritize patching of internet-facing and executive-use devices where message-based DoS could disrupt operations
- Enforce OS update compliance through MDM policies
Patch Information
Apple removed the vulnerable code in the following releases: iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2, and watchOS 10.5. Full details are available in the Apple Support Article HT214100, HT214101, HT214102, HT214104, HT214105, HT214106, HT214107, and HT214108.
Workarounds
- No official workaround has been published by Apple; upgrading to a patched OS build is the only supported remediation
- Restrict message delivery from untrusted senders where possible using messaging application filters
- Educate users to avoid interacting with unsolicited messages from unknown sources on Apple devices
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
