CVE-2024-27859: Apple iPadOS RCE Vulnerability

CVE-2024-27859 Overview

CVE-2024-27859 is a memory handling vulnerability affecting Apple's WebKit-based web content processing across multiple operating systems. Processing maliciously crafted web content can lead to arbitrary code execution on the targeted device. Apple addressed the issue with improved memory handling in iOS 17.4, iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, and watchOS 10.4. The flaw is classified under [CWE-94] Improper Control of Generation of Code (Code Injection) and requires user interaction, typically through visiting a malicious website.

Critical Impact

A remote attacker can achieve arbitrary code execution within the web content process when a victim renders attacker-controlled web content.

Affected Products

• Apple iOS and iPadOS prior to 17.4
• Apple macOS Sonoma prior to 14.4
• Apple tvOS prior to 17.4, visionOS prior to 1.1, and watchOS prior to 10.4

Discovery Timeline

• 2025-02-10 - CVE-2024-27859 published to the National Vulnerability Database
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2024-27859

Vulnerability Analysis

The vulnerability resides in the web content processing pipeline used by Apple operating systems. Improper memory handling during the parsing or rendering of crafted web content allows an attacker to corrupt process memory. Successful exploitation results in arbitrary code execution within the context of the web content process. The attack is conducted over the network and requires the victim to load attacker-controlled content, such as visiting a malicious page or opening a crafted document that renders web content.

Root Cause

Apple's advisories describe the root cause as a memory handling defect that was resolved through improved memory handling. The Common Weakness Enumeration mapping ([CWE-94]) indicates the flaw enables code generation control by an attacker. Memory handling defects in WebKit-class components commonly stem from use-after-free, type confusion, or out-of-bounds access during DOM, JavaScript, or media object lifecycle operations.

Attack Vector

Exploitation requires a victim to process attacker-supplied web content. An attacker hosts a malicious page, delivers it via phishing links, or embeds it in an application that renders web content using the affected system frameworks. Once the content is parsed, the memory corruption is triggered and the attacker's payload executes in the renderer process. The Exploit Prediction Scoring System (EPSS) probability is 0.256% with a percentile of 49.008, and no public proof-of-concept code or evidence of in-the-wild exploitation is currently associated with this CVE.

No verified public exploit code is available. Refer to the Apple Support Document #120881 for vendor-supplied technical context.

Detection Methods for CVE-2024-27859

Indicators of Compromise

• Unexpected child processes spawned by browser or WebKit-based application processes (for example, com.apple.WebKit.WebContent) on macOS endpoints.
• Crash logs referencing memory corruption in WebKit frameworks prior to patch installation.
• Outbound network connections from web content processes to untrusted hosts shortly after a user visits an unfamiliar URL.

Detection Strategies

• Monitor endpoint telemetry for anomalous behavior originating from Safari, WebKit renderer processes, and embedded web views.
• Inspect HTTP and TLS traffic for delivery of suspicious JavaScript, WebAssembly, or media payloads to Apple devices running unpatched OS versions.
• Correlate browser crash events with subsequent process execution or persistence activity on the same host.

Monitoring Recommendations

• Inventory all Apple endpoints and validate OS build versions against the patched baselines listed by Apple.
• Alert on devices reporting OS versions earlier than iOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, or watchOS 10.4.
• Track user interaction events that precede process anomalies to identify drive-by or phishing-driven exploitation attempts.

How to Mitigate CVE-2024-27859

Immediate Actions Required

• Update affected devices to iOS 17.4, iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, or watchOS 10.4 or later.
• Enforce OS update compliance through mobile device management (MDM) policies across managed Apple fleets.
• Educate users to avoid clicking unsolicited links and to report unexpected browser crashes.

Patch Information

Apple released coordinated security updates addressing this issue. Patch details are published in Apple Support Documents #120881, #120882, #120883, #120893, and #120895. Installing the listed OS versions or later remediates CVE-2024-27859.

Workarounds

• Restrict browsing on unpatched devices to trusted sites only and disable JavaScript where operationally feasible.
• Use network-level filtering or secure web gateways to block known malicious domains and reduce exposure to crafted web content.
• Where patching is delayed, isolate affected devices from sensitive corporate resources until updates are applied.

# Verify macOS version meets the patched baseline (Sonoma 14.4 or later)
sw_vers -productVersion

# Verify iOS/iPadOS version via MDM query or device Settings > General > About
# Required: 17.4 or later