⚠ Actively exploited
Added to CISA KEV on 2021-11-03. Federal agencies required to patch by 2021-11-17. Required action: Apply updates per vendor instructions..

CVE-2021-30860

CWE-190 — Integer OverflowCWE-20 — Improper Input Validation13 documents7 sources
Severity
7.8HIGH
EPSS
70.6%
top 1.31%
CISA KEV
KEV
Added 2021-11-03
Due 2021-11-17
Exploit
Exploited in wild
Active exploitation observed
Affected products
8
Apple IOSApple MacosApple Watchos+5 more
Timeline
PublishedAug 24
KEV addedNov 3
KEV dueNov 17
Latest updateApr 1
CISA Required Action: Apply updates per vendor instructions.

Description

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages10 packages

▶CVEListV5apple/macosunspecified — 11.6+1
▶NVDapple/macos< 11.6
▶NVDapple/ipados< 14.8
▶CVEListV5apple/watchosunspecified — 7.6
▶NVDapple/watchos< 7.6.2

🔴Vulnerability Details

4
Project0
The More You Know, The More You Know You Don’t Know - Project Zero↗2022-04-01
▶
Project0
A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution - Project Zero↗2021-12-01
▶
CVEList
CVE-2021-30860: An integer overflow was addressed with improved input validation↗2021-08-24
▶
VulnCheck
Apple Multiple Products Integer Overflow Vulnerability↗2021
▶

📋Vendor Advisories

6
CISA
Apple Multiple Products Integer Overflow Vulnerability↗2021-11-03
▶
Apple
CVE-2021-30860: iOS 12.5.5↗2021-09-23
▶
Apple
CVE-2021-30860: macOS Big Sur 11.6↗2021-09-13
▶
Apple
CVE-2021-30860: watchOS 7.6.2↗2021-09-13
▶
Apple
CVE-2021-30860: Security Update 2021-005 Catalina↗2021-09-13
▶
CVE-2021-30860 (HIGH CVSS 7.8) | An integer overflow was addressed w | cvebase.io