CVE-2024-27831 is a memory corruption vulnerability classified as an out-of-bounds write in Apple's CoreMedia framework. This flaw allows processing of a maliciously crafted file to cause unexpected application termination or enable arbitrary code execution. The vulnerability affects multiple Apple operating systems including iOS and iPadOS on devices from iPhone XS and later, and iPad Pro models. Apple fixed the issue by improving input validation and memory handling in the affected components. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Official security updates addressing this issue were released on May 13, 2024, in iOS 16.7.8, iOS 17.5, and corresponding iPadOS versions, among others. The vendor advisory confirms the fix and recommends updating to these versions. No public exploitation has been reported.

Successful exploitation of this vulnerability may allow a local attacker to cause unexpected app termination or execute arbitrary code within the context of the affected application, potentially leading to privilege escalation or system compromise. The CVSS vector indicates that exploitation requires local access with high attack complexity and privileges, but no user interaction. The impact includes full confidentiality, integrity, and availability compromise of the affected system components.

A fix is available and has been officially released by Apple in iOS 16.7.8, iOS 17.5, iPadOS 16.7.8, iPadOS 17.5, and corresponding updates for macOS, tvOS, and visionOS. Users and administrators should apply these updates promptly to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.