{"id":"CVE-2021-30860","kind":"vulnerability","aliases":["CVE-2021-30860"],"related":[],"title":"Apple Multiple Products: Apple Multiple Products Integer Overflow Vulnerability","description":"An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.","summary":"Apple CoreGraphics on iOS, iPadOS, macOS and watchOS has an integer overflow when rendering a crafted PDF. An attacker who sends a malicious PDF can run code on the device, known in the wild as FORCEDENTRY.","severity":"critical","cvss":7.8,"epss":0.75994,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Apple Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple-devices","exploited","ios","ipados","macos","vendor","watchos"],"not_affected_if":["fully-patched-devices"],"how_to_check":"Check the device OS version under Settings > General > About (iOS/iPadOS) or About This Mac (macOS) and compare it to the patched release in Apple's security notes.","fix":"Update iOS, iPadOS, macOS and watchOS to a release that includes the Apple fix for CVE-2021-30860, per Apple's vendor instructions.","status":"open","published_at":"2021-08-24T19:15:14+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:32:07+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:32:07Z","model":"claude-haiku-5-5","output":{"fix":"Update iOS, iPadOS, macOS and watchOS to a release that includes the Apple fix for CVE-2021-30860, per Apple's vendor instructions.\nunknown","reach":"internet","impact":"high","summary":"Apple CoreGraphics on iOS, iPadOS, macOS and watchOS has an integer overflow when rendering a crafted PDF. An attacker who sends a malicious PDF can run code on the device, known in the wild as FORCEDENTRY.","category":"vendor","who_cares":["ios","ipados","macos","watchos","apple-devices"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code on the device via a crafted PDF, with no click needed.","analyst_note":"Get the exact patched Apple OS versions from Apple's security releases page for CVE-2021-30860; the sources given do not list them.","how_to_check":"Check the device OS version under Settings > General > About (iOS/iPadOS) or About This Mac (macOS) and compare it to the patched release in Apple's security notes.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["fully-patched-devices"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000508,"input_tokens":2869,"output_tokens":443,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-005':81C '-2021':11A,14A '-30860':12A,15A '11.6':91C '14.8':84C,87C '2021':80C '7.6.2':93C 'activ':117C 'address':68C 'appl':1A,4A,20B,28B,105C 'apple':16A 'apple-devic':19B 'arbitrari':102C 'attack':46B 'awar':107C 'big':89C 'catalina':82C 'code':54B,103C 'coregraph':29B 'craft':43B,97C 'cve':10A,13A 'devic':21B,57B 'execut':104C 'exploit':22B,118C 'fix':76C 'forcedentri':63B 'improv':70C 'input':71C 'integ':7A,38B,65C 'io':23B,31B,83C 'ipado':24B,32B,86C 'issu':74C,113C 'known':58B 'lead':100C 'maco':25B,33B,88C 'malici':50B,96C 'may':99C,114C 'multipl':2A,5A 'multiple':17A 'overflow':8A,39B,66C 'pdf':44B,51B,98C 'process':94C 'product':3A,6A 'products':18A 'render':41B 'report':110C 'run':53B 'secur':78C 'send':48B 'sur':90C 'updat':79C 'valid':72C 'vendor':26B 'vulner':9A 'watcho':27B,35B,92C 'wild':61B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-08-24T19:15:14+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-30860","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30860","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2021-30860","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30860","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-30860","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30860","severity":null,"published_at":"2021-08-24T19:15:14+00:00","modified_at":"2026-06-17T03:51:01+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}