Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-27837: A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. A local attacker may gain access to Keychain items.

CVE-2024-27837 · published 2 years ago

Summary

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. A local attacker may gain access to Keychain items.

What to do

Update apple macos to version 14.5 or later.

Affected software

Vendor	Product	Affected versions
apple	macos	>= 14.0, < 14.5 `cpe:2.3:o:apple:macos::::::::`

Original advisory text

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. A local attacker may gain access to Keychain items.

References

https://support.apple.com/en-us/120903
http://seclists.org/fulldisclosure/2024/May/12 Mailing List
https://support.apple.com/en-us/HT214106 Vendor Advisory
https://support.apple.com/kb/HT214106 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

3.3 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-280Improper Handling of Insufficient Permissions or Privileges

Timeline

Published14 May 2024

Updated26 Oct 2026

First seen29 Sep 2026

Sources

CVE-2024-27837 · NVD

Track software like this

Free during beta