CVE-2024-27851 is a memory safety vulnerability in Apple Safari that could allow an attacker to execute arbitrary code by processing specially crafted web content. The root cause was insufficient bounds checking leading to potential out-of-bounds memory access. Apple fixed this issue by improving bounds checks and memory handling in Safari 17.5 and related OS updates (iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5). The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The CVSS vector indicates the attack requires network access, high attack complexity, no privileges, but user interaction is needed. The impact includes potential full compromise of confidentiality, integrity, and availability of the affected system. Apple has officially released patches addressing this vulnerability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code within the context of Safari, potentially leading to full compromise of the affected device's confidentiality, integrity, and availability. The CVSS score of 7.5 indicates a high severity impact. However, exploitation requires user interaction and has high attack complexity. There are no known active exploits in the wild at the time of this report.

Apple has released official patches for this vulnerability in Safari 17.5 and corresponding updates for iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, and watchOS 10.5. Users and administrators should apply these updates promptly to remediate the vulnerability. No additional mitigation actions are required beyond applying the official updates.