CVE-2024-27817 is a vulnerability in the CoreMedia framework of Apple iOS and iPadOS that could allow a malicious app to execute arbitrary code with kernel privileges by exploiting an out-of-bounds write condition. This issue was mitigated by Apple through improved input validation and memory handling. The vulnerability affects multiple Apple platforms and device generations. Official patches have been released in iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, and related OS versions. The vulnerability has a CVSS 3.1 base score of 7.8, reflecting high impact on confidentiality, integrity, and availability. No public exploitation has been reported.

Successful exploitation of this vulnerability could allow a local app to execute arbitrary code with kernel privileges, potentially leading to full system compromise including unauthorized access to sensitive data, system integrity breaches, and denial of service. The vulnerability affects confidentiality, integrity, and availability of the affected devices. No known exploits in the wild have been reported, but the high CVSS score indicates significant risk if exploited.

Apple has released official security updates that address CVE-2024-27817 in iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, and iPadOS 17.5. Users and administrators should apply these updates promptly to mitigate the vulnerability. Since this is not a cloud service, remediation depends on updating the affected devices. No additional mitigation steps are indicated by the vendor advisory.