Actively exploited · Published Aug 24, 2021 · Assigned by apple

CVE-2021-30860

High 7.8 Exploited

In plain English

A high-severity integer overflow in iOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 76.0% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)76.0%top 0.5% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack tooling1Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Nov 17, 2021.

Official description

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Affected products (as reported)

Vendor	Product	Versions
Apple	macOS	unspecified – before 11.6
Apple	macOS	unspecified – before 2021-005
Apple	watchOS	unspecified – before 7.6
Apple	iOS	unspecified – before 14.8

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://support.apple.com/en-us/HT212804 x_refsource_MISC
https://support.apple.com/en-us/HT212805 x_refsource_MISC
https://support.apple.com/en-us/HT212807 x_refsource_MISC
https://support.apple.com/en-us/HT212806 x_refsource_MISC
20210917 APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina mailing-list, x_refsource_FULLDISC
20210917 APPLE-SA-2021-09-13-3 macOS Big Sur 11.6 mailing-list, x_refsource_FULLDISC
20210917 APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8 mailing-list, x_refsource_FULLDISC
20210917 APPLE-SA-2021-09-13-2 watchOS 7.6.2 mailing-list, x_refsource_FULLDISC
20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina mailing-list, x_refsource_FULLDISC
20210921 APPLE-SA-2021-09-20-6 Additional information for APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8 mailing-list, x_refsource_FULLDISC
20210921 APPLE-SA-2021-09-20-7 Additional information for APPLE-SA-2021-09-13-3 macOS Big Sur 11.6 mailing-list, x_refsource_FULLDISC
https://support.apple.com/kb/HT212824 x_refsource_CONFIRM
20210924 APPLE-SA-2021-09-23-1 iOS 12.5.5 mailing-list, x_refsource_FULLDISC
[oss-security] 20220902 JBIG2 integer overflow fixed in Xpdf 4.04, Poppler 22.09.0 mailing-list, x_refsource_MLIST
GLSA-202209-21 vendor-advisory, x_refsource_GENTOO
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30860 government-resource