CVE-2021-30860

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Affected

Apple · macOS · watchOS · iOS

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

75.99% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2021-11-03

Published

2021-08-24

Updated

2025-10-21

Proof-of-concept exploits (3)

• 30440r/gex6★ · 2022-02-12
• Levilutz/CVE-2021-3086013★ · 2021-09-21
• jeffssh/CVE-2021-30860103★ · 2024-03-30

Security advisories

• https://support.apple.com/en-us/HT212804
• https://support.apple.com/en-us/HT212805
• https://support.apple.com/en-us/HT212806
• https://support.apple.com/en-us/HT212807
• https://support.apple.com/kb/HT212824
• http://seclists.org/fulldisclosure/2021/Sep/25
• http://seclists.org/fulldisclosure/2021/Sep/26
• http://seclists.org/fulldisclosure/2021/Sep/27
• http://seclists.org/fulldisclosure/2021/Sep/28
• http://seclists.org/fulldisclosure/2021/Sep/38
• http://seclists.org/fulldisclosure/2021/Sep/39
• http://seclists.org/fulldisclosure/2021/Sep/40
• http://seclists.org/fulldisclosure/2021/Sep/50
• https://security.gentoo.org/glsa/202209-21

References

• CVE Record
• NVD entry

Related

• CVE-2021-30807
• CVE-2022-29807