CVE-2024-27839 is a privacy issue in Apple iOS and iPadOS where a malicious application may be able to determine a user's current location by accessing sensitive data improperly stored. Apple addressed this vulnerability by relocating sensitive location data to a more secure location in the operating system. The fix is included in iOS 17.5 and iPadOS 17.5, released on May 13, 2024. The vulnerability affects a broad range of Apple devices starting from iPhone XS and corresponding iPad models. The CVSS 3.1 vector indicates the attack requires local access with low attack complexity, no privileges, and user interaction, impacting confidentiality with high impact but no integrity or availability impact.

A malicious application running on a vulnerable iOS or iPadOS device may be able to determine the user's current location without proper authorization, leading to a privacy breach. The confidentiality of location data is impacted, but there is no indication of integrity or availability impact. There are no known exploits in the wild, and the issue is rated medium severity with a CVSS score of 5.5.

Apple has released an official fix for this vulnerability in iOS 17.5 and iPadOS 17.5. Users and administrators should update affected devices to these versions or later to mitigate the risk. Since this is a local vulnerability requiring user interaction, applying the update is the primary and effective mitigation. No additional vendor-recommended mitigations are necessary.