high
7.7
CWE
280
Advisory Published
CVE Published
Updated

CVE-2024-27837

First published: Mon May 13 2024(Updated: )

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. A local attacker may gain access to Keychain items.

Credit: product-security@apple.com Mickey Jin @patch1t ajajfxhj Minghao Lin Baidu Security Baidu SecurityYe Zhang @VAR10CK Baidu SecurityMeysam Firouzi @R00tkitSMM Kirin @Pwnrin Amir Bazine CrowdStrike Counter Adversary OperationsKarsten König CrowdStrike Counter Adversary OperationsPwn2car Trend Micro's Zero Day Initiative Trend Micro's Zero Day InitiativeMichael DePlante @izobashi Trend Micro's Zero Day Initiativean anonymous researcher Ron Masas Imperva小来来 @Smi1eSEC pattern-f @pattern_F_ Ant Security LightCertiK SkyFall Team Junsung Lee Trend Micro Zero Day Initiativean anonymous researcher MIT CSAIL MIT CSAILJoseph Ravichandran @0xjprx MIT CSAILPr BarPr Hebrew University EP Nick Wellnhofer Gil Pedersen Dohyun Lee @l33d0hyun LFY @secsys Fudan UniversityDaniel Zajork Joshua Zajork Meysam Firouzi @R00tkitsmm Trend Micro Zero Day InitiativeMichael DePlante @izobashi Trend Micro Zero Day InitiativeScott Johnson RIPEDA ConsultingMykola Grymalyuk RIPEDA ConsultingJordy Witteman Carlos Polop Pedro Tôrres @t0rr3sp3dr0 Narendra Bhati Suma Soft PvtShaheen Fazim Csaba Fitzl @theevilbit KandjiLFY @secsys yulige Snoolie Keffaber @0xilis Robert Reichel CVE-2024-27806 Yann GASCUEL Alter SolutionsMaksymilian Motyl Immunity SystemsManfred Paul @_manfp Trend Micro's Zero Day InitiativeEmilio Cobos MozillaLukas Bernhard CISPA Helmholtz Center for Information SecurityNan Wang @eternalsakura13 360 Vulnerability Research InstituteJoe Rutkowski @Joe12387 Crawless @abrahamjuliot Jeff Johnson underpassapp

Affected SoftwareAffected VersionHow to fix
Apple macOS>=14.0<14.5
Apple macOS<14.5
14.5
<14.5
14.5

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Peer vulnerabilities

(Found alongside the following vulnerabilities)

Frequently Asked Questions

  • What is the severity of CVE-2024-27837?

    CVE-2024-27837 has been rated as high severity due to its potential impact on Keychain item access.

  • How do I fix CVE-2024-27837?

    To fix CVE-2024-27837, update your macOS to version 14.5 or later.

  • Who is affected by CVE-2024-27837?

    CVE-2024-27837 affects users running macOS versions from 14.0 up to but not including 14.5.

  • What components are involved in CVE-2024-27837?

    CVE-2024-27837 involves issues with code-signing restrictions and memory handling in macOS.

  • What potential risks does CVE-2024-27837 pose?

    CVE-2024-27837 poses a risk of unauthorized access to sensitive data stored in the Keychain.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203