CVE-2024-27876

A race condition was addressed with improved locking. This issue is fixed in macOS Ventura 13.7, iOS 17.7 and iPadOS 17.7, visionOS 2, iOS 18 and iPadOS 18, macOS Sonoma 14.7, macOS Sequoia 15. Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files.

Affected

Apple · iOS and iPadOS · macOS · visionOS

CVSS v3.1 NVD

5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v3.1 CNA

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS

0.49% chance of exploitation in the next 30 days, 41st percentile

Published

2024-09-16

Updated

2026-04-02

Proof-of-concept exploits (1)

• 0xilis/CVE-2024-2787646★ · 2025-04-23

Security advisories

• https://support.apple.com/en-us/121234
• https://support.apple.com/en-us/121238
• https://support.apple.com/en-us/121246
• https://support.apple.com/en-us/121247
• https://support.apple.com/en-us/121249
• https://support.apple.com/en-us/121250

References

• CVE Record
• NVD entry

Related

• CVE-2024-27821