CVE-2021-30860

KEVApple Multiple Products Integer Overflow Vulnerability

Description

Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY.

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

PublishedAug 24, 2021

Last modifiedJun 17, 2026

Added to KEVNov 3, 2021

Remediation dueNov 17, 2021

References

seclists.org/fulldisclosure/2021/Sep/25Mailing ListThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/26Mailing ListThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/27Mailing ListThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/28Mailing ListThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/38Mailing ListThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/39Mailing ListThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/40Mailing ListThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/50Mailing ListThird Party Advisory
openwall.com/lists/oss-security/2022/09/02/11Mailing List
security.gentoo.org/glsa/202209-21Third Party Advisory
support.apple.com/en-us/HT212804Vendor Advisory
support.apple.com/en-us/HT212805Vendor Advisory

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1806 days
CVSS: 7.8 HIGH
EPSS (30-day exploit probability): 76.0% · top 1% of all CVEs
Weakness: CWE-190

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.