CVE-2024-27799 is a security vulnerability affecting Apple iOS, iPadOS, and macOS Ventura where an unprivileged application could log keystrokes from other applications, including those that use secure input mode. The vulnerability arises from insufficient entitlement checks that allowed unauthorized access to keystroke data. Apple fixed this issue by implementing additional entitlement checks in iOS 16.7.8, iPadOS 16.7.8, and macOS Ventura 13.6.7. The CVSS v3.1 base score is 3.3, reflecting a low severity with local attack vector, low complexity, no privileges required, and user interaction needed. The impact is limited to confidentiality loss without integrity or availability impact. No known active exploitation has been reported.

An unprivileged app could potentially capture keystrokes from other apps, including those using secure input mode, which may lead to unauthorized disclosure of sensitive input data. The impact is limited to confidentiality (partial information disclosure) with no integrity or availability effects. The CVSS score of 3.3 corresponds to a low severity vulnerability. There are no reports of known exploits in the wild.

Apple has released official patches addressing this vulnerability in iOS 16.7.8, iPadOS 16.7.8, and macOS Ventura 13.6.7. Users and administrators should apply these updates promptly to remediate the issue. The vendor advisory confirms the issue is fixed with additional entitlement checks, so no further mitigation steps are required beyond updating to the fixed versions.