CVE-2024-27810 is a vulnerability in Apple iOS, iPadOS, and macOS Sonoma 14.5 involving improper path handling that could allow a malicious app to read sensitive location information. The issue was resolved by Apple through improved validation mechanisms in the affected operating system versions. The vulnerability has a critical CVSS 3.1 base score of 9.8, reflecting its potential impact and ease of exploitation without privileges or user interaction. Apple’s official security advisories confirm that patches are available in iOS 17.5, iPadOS 17.5, and macOS Sonoma 14.5 released on May 13, 2024.

An attacker controlling a malicious app on affected Apple devices could read sensitive location data without user consent, potentially compromising user privacy. The vulnerability affects confidentiality, integrity, and availability of the system as per the CVSS vector. There are no reports of active exploitation in the wild. The impact is significant given the sensitivity of location information and the lack of required privileges or user interaction for exploitation.

Apple has released official patches for this vulnerability in iOS 17.5, iPadOS 17.5, and macOS Sonoma 14.5. Users and administrators should apply these updates promptly to remediate the issue. Since the vendor advisory confirms the availability of fixes, no additional mitigations are required beyond updating to the patched versions.