# Sonoma 14.5

Sonoma 14.5, released May 13, 2024, fixes 51 CVEs in Sonoma. 2 of them are being exploited (CVE-2024-27834); 1 on CISA KEV. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/fix/macos/sonoma-14.5
- Platform: macOS
- Released: May 13, 2024
- Priority: Patch now (Closes CVE-2024-27834, exploited (CISA KEV))
- CVEs: 51, exploited: 2, on CISA KEV: 1
- Vendor advisory: https://support.apple.com/en-us/120903

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [Sonoma](https://patchblox.com/security/data/product/macos/sonoma.md) |  | 14.5 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2024-27834](https://patchblox.com/security/data/cve/CVE-2024-27834.md) | Patch now | WebKit: An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication | 8.8 | 0.0150 | CISA KEV |
| [CVE-2024-40771](https://patchblox.com/security/data/cve/CVE-2024-40771.md) | Patch now | AVEVideoEncoder: An app may be able to execute arbitrary code with kernel privileges | 8.4 | 0.0018 | Exploited |
| [CVE-2024-27810](https://patchblox.com/security/data/cve/CVE-2024-27810.md) | Urgent | Maps: An app may be able to read sensitive location information | 9.8 | 0.0071 |  |
| [CVE-2024-27832](https://patchblox.com/security/data/cve/CVE-2024-27832.md) | Urgent | Disk Images: An app may be able to elevate privileges | 9.1 | 0.0059 |  |
| [CVE-2024-27811](https://patchblox.com/security/data/cve/CVE-2024-27811.md) | Urgent | libiconv: An app may be able to elevate privileges | 9.1 | 0.0056 |  |
| [CVE-2024-27844](https://patchblox.com/security/data/cve/CVE-2024-27844.md) | Urgent | Safari: A website's permission dialog may persist after navigation away from the site | 9.1 | 0.0056 |  |
| [CVE-2024-27841](https://patchblox.com/security/data/cve/CVE-2024-27841.md) | Urgent | AVEVideoEncoder: An app may be able to disclose kernel memory | 9.8 | 0.0044 |  |
| [CVE-2024-27857](https://patchblox.com/security/data/cve/CVE-2024-27857.md) | High | Metal: A remote attacker may be able to cause unexpected app termination or arbitrary code execution | 7.1 | 0.0183 |  |
| [CVE-2024-27822](https://patchblox.com/security/data/cve/CVE-2024-27822.md) | High | PackageKit: An app may be able to gain root privileges | 7.4 | 0.0146 |  |
| [CVE-2024-27804](https://patchblox.com/security/data/cve/CVE-2024-27804.md) | High | AppleAVD: An app may be able to cause unexpected system termination | 8.1 | 0.0131 |  |
| [CVE-2024-27808](https://patchblox.com/security/data/cve/CVE-2024-27808.md) | High | WebKit: Processing web content may lead to arbitrary code execution | 8.8 | 0.0118 |  |
| [CVE-2024-27820](https://patchblox.com/security/data/cve/CVE-2024-27820.md) | High | WebKit Web Inspector: Processing web content may lead to arbitrary code execution | 8.8 | 0.0102 |  |
| [CVE-2024-27821](https://patchblox.com/security/data/cve/CVE-2024-27821.md) | High | Shortcuts: A shortcut may output sensitive user data without consent | 7.5 | 0.0092 |  |
| [CVE-2024-27851](https://patchblox.com/security/data/cve/CVE-2024-27851.md) | High | WebKit: Processing maliciously crafted web content may lead to arbitrary code execution | 8.8 | 0.0082 |  |
| [CVE-2024-27818](https://patchblox.com/security/data/cve/CVE-2024-27818.md) | High | Kernel: An attacker may be able to cause unexpected app termination or arbitrary code execution | 7.8 | 0.0073 |  |
| [CVE-2024-27855](https://patchblox.com/security/data/cve/CVE-2024-27855.md) | High | Shortcuts: A shortcut may be able to use sensitive data with certain actions without prompting the user | 8.8 | 0.0072 |  |
| [CVE-2024-27829](https://patchblox.com/security/data/cve/CVE-2024-27829.md) | High | AppleVA: Processing a file may lead to unexpected app termination or arbitrary code execution | 7.5 | 0.0063 |  |
| [CVE-2024-27856](https://patchblox.com/security/data/cve/CVE-2024-27856.md) | High | WebKit: Processing a file may lead to unexpected app termination or arbitrary code execution | 8.8 | 0.0062 |  |
| [CVE-2024-27800](https://patchblox.com/security/data/cve/CVE-2024-27800.md) | High | Messages: Processing a maliciously crafted message may lead to a denial-of-service | 7.1 | 0.0060 |  |
| [CVE-2024-27802](https://patchblox.com/security/data/cve/CVE-2024-27802.md) | High | Metal: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution | 7.8 | 0.0042 |  |
| [CVE-2024-27836](https://patchblox.com/security/data/cve/CVE-2024-27836.md) | High | ImageIO: Processing a maliciously crafted image may lead to arbitrary code execution | 7.8 | 0.0038 |  |
| [CVE-2024-27801](https://patchblox.com/security/data/cve/CVE-2024-27801.md) | High | Foundation: An app may be able to elevate privileges | 8.4 | 0.0036 |  |
| [CVE-2024-27842](https://patchblox.com/security/data/cve/CVE-2024-27842.md) | High | udf: An app may be able to execute arbitrary code with kernel privileges | 8.1 | 0.0033 |  |
| [CVE-2024-27831](https://patchblox.com/security/data/cve/CVE-2024-27831.md) | High | CoreMedia: Processing a file may lead to unexpected app termination or arbitrary code execution | 7.5 | 0.0030 |  |
| [CVE-2024-27826](https://patchblox.com/security/data/cve/CVE-2024-27826.md) | High | Apple Neural Engine: An app may be able to execute arbitrary code with kernel privileges | 7.8 | 0.0026 |  |
| [CVE-2024-27796](https://patchblox.com/security/data/cve/CVE-2024-27796.md) | High | Voice Control: An attacker may be able to elevate privileges | 8.1 | 0.0026 |  |
| [CVE-2024-27824](https://patchblox.com/security/data/cve/CVE-2024-27824.md) | High | PackageKit: An app may be able to elevate privileges | 7.8 | 0.0023 |  |
| [CVE-2024-27847](https://patchblox.com/security/data/cve/CVE-2024-27847.md) | High | Sync Services: An app may be able to bypass Privacy preferences | 7.4 | 0.0022 |  |
| [CVE-2024-27843](https://patchblox.com/security/data/cve/CVE-2024-27843.md) | High | SharedFileList: An app may be able to elevate privileges | 7.8 | 0.0022 |  |
| [CVE-2024-27798](https://patchblox.com/security/data/cve/CVE-2024-27798.md) | High | StorageKit: An attacker may be able to elevate privileges | 7.8 | 0.0020 |  |
| [CVE-2024-27848](https://patchblox.com/security/data/cve/CVE-2024-27848.md) | High | StorageKit: A malicious app may be able to gain root privileges | 7.4 | 0.0020 |  |
| [CVE-2024-27825](https://patchblox.com/security/data/cve/CVE-2024-27825.md) | High | AppleMobileFileIntegrity: An app may be able to bypass certain Privacy preferences | 7.8 | 0.0019 |  |
| [CVE-2024-27817](https://patchblox.com/security/data/cve/CVE-2024-27817.md) | High | CoreMedia: An app may be able to execute arbitrary code with kernel privileges | 7.8 | 0.0018 |  |
| [CVE-2024-27837](https://patchblox.com/security/data/cve/CVE-2024-27837.md) | High | AppleMobileFileIntegrity: A local attacker may gain access to Keychain items | 7.7 | 0.0018 |  |
| [CVE-2024-27815](https://patchblox.com/security/data/cve/CVE-2024-27815.md) | Routine | Kernel: An app may be able to execute arbitrary code with kernel privileges | 5.9 | 0.0205 |  |
| [CVE-2024-27816](https://patchblox.com/security/data/cve/CVE-2024-27816.md) | Routine | AppleMobileFileIntegrity: An attacker may be able to access user data | 5.3 | 0.0098 |  |
| [CVE-2024-27838](https://patchblox.com/security/data/cve/CVE-2024-27838.md) | Routine | WebKit: A maliciously crafted webpage may be able to fingerprint the user | 6.5 | 0.0073 |  |
| [CVE-2024-27823](https://patchblox.com/security/data/cve/CVE-2024-27823.md) | Routine | Kernel: An attacker in a privileged network position may be able to spoof network packets | 5.9 | 0.0068 |  |
| [CVE-2024-27830](https://patchblox.com/security/data/cve/CVE-2024-27830.md) | Routine | WebKit Canvas: A maliciously crafted webpage may be able to fingerprint the user | 6.5 | 0.0065 |  |
| [CVE-2024-27850](https://patchblox.com/security/data/cve/CVE-2024-27850.md) | Routine | WebKit: A maliciously crafted webpage may be able to fingerprint the user | 6.5 | 0.0065 |  |
| [CVE-2024-27813](https://patchblox.com/security/data/cve/CVE-2024-27813.md) | Routine | PrintCenter: An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges | 5.3 | 0.0039 |  |
| [CVE-2024-23251](https://patchblox.com/security/data/cve/CVE-2024-23251.md) | Routine | Mail: An attacker with physical access may be able to leak Mail account credentials | 4.6 | 0.0037 |  |
| [CVE-2024-27885](https://patchblox.com/security/data/cve/CVE-2024-27885.md) | Routine | PackageKit: An app may be able to modify protected parts of the file system | 6.3 | 0.0027 |  |
| [CVE-2023-42893](https://patchblox.com/security/data/cve/CVE-2023-42893.md) | Routine | Libsystem: An app may be able to access protected user data | 5.5 | 0.0026 |  |
| [CVE-2024-27806](https://patchblox.com/security/data/cve/CVE-2024-27806.md) | Routine | Spotlight: An app may be able to access sensitive user data | 5.5 | 0.0026 |  |
| [CVE-2024-23236](https://patchblox.com/security/data/cve/CVE-2024-23236.md) | Routine | CFNetwork: An app may be able to read arbitrary files | 5.5 | 0.0025 |  |
| [CVE-2024-27884](https://patchblox.com/security/data/cve/CVE-2024-27884.md) | Routine | Transparency: An app may be able to access user-sensitive data | 5.5 | 0.0025 |  |
| [CVE-2024-27827](https://patchblox.com/security/data/cve/CVE-2024-27827.md) | Routine | Finder: An app may be able to read arbitrary files | 6.2 | 0.0025 |  |
| [CVE-2024-27805](https://patchblox.com/security/data/cve/CVE-2024-27805.md) | Routine | Core Data: An app may be able to access sensitive user data | 5.5 | 0.0025 |  |
| [CVE-2024-23282](https://patchblox.com/security/data/cve/CVE-2024-23282.md) | Routine | Mail: A maliciously crafted email may be able to initiate FaceTime calls without user authorization | 5.5 | 0.0024 |  |
| [CVE-2024-27799](https://patchblox.com/security/data/cve/CVE-2024-27799.md) | Routine | IOHIDFamily: An unprivileged app may be able to log keystrokes in other apps including those using secure input mode | 3.3 | 0.0024 |  |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.