VulnerabilityPublished 11 Dec 2024Updated 2 Apr 2026

CVE-2024-54527: Apple iOS and iPadOS · An app may be able to access sensitive user data

Affects Apple iOS and iPadOSSource CVE Database V5

Not known to be exploited · CVSS 5.5 Medium · fixed in 18.2 : update Apple iOS and iPadOS when convenient.

Data as of 26 Oct 2026, 10:12 UTC

CVSS 3.1 base score

5.5Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 20% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 18.2

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 11 Dec 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Apple iOS and iPadOS	Affected =0	Fixed in–

AI-suggested

To mitigate CVE-2024-54527, organizations should: 1) Immediately deploy the security updates provided by Apple, including iOS 18.2, iPadOS 18.2, and corresponding patches for macOS, tvOS, and watchOS, to all affected devices. 2) Enforce strict mobile device management (MDM) policies to control app installations, limiting devices to trusted app stores and verified applications only. 3) Regularly audit installed applications and permissions to detect and remove any suspicious or unauthorized apps that could exploit this vulnerability. 4) Educate users about the risks of installing untrusted apps and the importance of keeping devices updated. 5) Implement network segmentation and access controls to limit the ability of compromised devices to access sensitive corporate resources. 6) Use endpoint detection and response (EDR) tools capable of monitoring for anomalous app behavior indicative of exploitation attempts. 7) For high-security environments, consider additional device hardening measures such as restricting local user privileges and disabling unnecessary services. These steps go beyond generic patching by emphasizing proactive device hygiene, user awareness, and monitoring to reduce the likelihood and impact of exploitation.

Description

This issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, watchOS 11.2. An app may be able to access sensitive user data.

Impact

The primary impact of CVE-2024-54527 is unauthorized access to sensitive user data on Apple devices running vulnerable versions of iOS, iPadOS, and related operating systems. For organizations, this could lead to leakage of confidential information, including personal data, corporate emails, credentials, or other sensitive content stored or accessible on these devices. Since the vulnerability does not affect integrity or availability, it is less likely to cause system disruption or data manipulation. However, the confidentiality breach can have serious consequences such as privacy violations, regulatory non-compliance (e.g., GDPR, HIPAA), and reputational damage. The requirement for local access and low privileges limits the attack surface primarily to users who install malicious apps or have physical or remote access to the device. This reduces the risk of widespread remote exploitation but raises concerns in environments where device control is less stringent, such as BYOD scenarios or unmanaged devices. The lack of user interaction needed for exploitation increases the stealthiness of potential attacks. Organizations with large deployments of Apple devices, especially in sectors handling sensitive data like finance, healthcare, and government, face higher risks. The vulnerability also underscores the need for robust app vetting and device management policies to prevent unauthorized app installations.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 3 Apr 2026, 00:23 UTC

Technical details

References

Community reviews

Related threats