CVE-2021-30860
Apple Multiple Products Integer Overflow Vulnerability
Description
CVE-2021-30860 is a HIGH severity integer overflow vulnerability in Apple's CoreGraphics framework, widely known as FORCEDENTRY. The flaw exists in the processing of PDF files, where a maliciously crafted PDF can trigger an integer overflow leading to arbitrary code execution. With a CVSS 3.1 score of 7.8, this vulnerability was infamously exploited by NSO Group's Pegasus spyware as a zero-click exploit targeting journalists, activists, and government officials worldwide. It affects iOS (before 14.8), iPadOS (before 14.8), macOS (before Big Sur 11.6 and Security Update 2021-005 Catalina), and watchOS (before 7.6.2). CISA added CVE-2021-30860 to its KEV catalog on November 3, 2021, with an urgent remediation deadline of November 17, 2021. The EPSS score of 0.72863 (98.76th percentile) reflects an exceptionally high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 14.8 |
| apple | iphone os | < 12.5.5; >= 13.0, < 14.8 |
| apple | mac os x | >= 10.15, < 10.15.7; 10.15.7 |
| apple | macos | < 11.6 |
| apple | watchos | < 7.6.2 |
| xpdfreader | xpdf | < 4.04 |
| freedesktop | poppler | < 22.09.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://seclists.org/fulldisclosure/2021/Sep/25(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2021/Sep/26(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2021/Sep/27(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2021/Sep/28(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2021/Sep/38(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2021/Sep/39(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2021/Sep/40(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2021/Sep/50(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2022/09/02/11(Mailing List)
- https://security.gentoo.org/glsa/202209-21(Third Party Advisory)
- https://support.apple.com/en-us/HT212804(Vendor Advisory)
- https://support.apple.com/en-us/HT212805(Vendor Advisory)
- https://support.apple.com/en-us/HT212806(Vendor Advisory)
- https://support.apple.com/en-us/HT212807(Vendor Advisory)
- https://support.apple.com/kb/HT212824(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30860(US Government Resource)
Weakness Type
CWE-190: Integer Overflow or Wraparound
Integer Overflow or Wraparound occurs when an arithmetic operation produces a numeric value that exceeds the maximum value that can be stored in the target integer type. When this happens, the value wraps around to a small number (or negative number for signed integers). Integer overflows are particularly dangerous when the result is used for memory allocation sizes, array indices, or security-critical calculations.
In the context of CVE-2021-30860, the integer overflow occurs within Apple's CoreGraphics framework during the parsing of JBIG2 data embedded within PDF files. JBIG2 is a compression standard used for bi-level (black and white) images, commonly found in scanned documents. The exploit leverages a carefully crafted JBIG2 stream that triggers an integer overflow in size calculations during image decoding. This overflow causes an undersized memory buffer to be allocated, which is subsequently overwritten with attacker-controlled data. The NSO Group's FORCEDENTRY exploit chain exploited this vulnerability to construct a sophisticated virtual machine within the JBIG2 context, achieving arbitrary code execution without any user interaction — a true zero-click exploit delivered via iMessage.
Learn more: CWE-190 — Integer Overflow or Wraparound
Impact Analysis
CVE-2021-30860 carries a CVSS 3.1 base score of 7.8 (HIGH) with local attack characteristics requiring user interaction (opening a crafted PDF), though in practice the FORCEDENTRY exploit chain delivered the payload as a zero-click iMessage attack.
Confidentiality (High): Successful exploitation grants full arbitrary code execution on the target device. In the Pegasus spyware context, this enabled complete access to the victim's messages (including encrypted messengers like Signal and WhatsApp), emails, photos, location data, microphone, and camera. Every piece of data on the device becomes accessible to the attacker, including credentials, authentication tokens, and encrypted communications.
Integrity (High): Arbitrary code execution allows the attacker to modify any data on the device, install persistent surveillance implants, modify system configurations, and tamper with security mechanisms. The Pegasus spyware installed itself persistently and could survive reboots on some device configurations, fundamentally compromising device integrity.
Availability (High): While the Pegasus exploitation chain was designed to be stealthy rather than disruptive, the arbitrary code execution capability could be used to render devices inoperable, delete data, or cause system crashes. The attacker has full control over device functionality.
Scope (Unchanged): While technically scoped to the vulnerable application context, the practical impact through kernel exploitation chains extends to complete device compromise. The FORCEDENTRY exploit was part of a multi-stage chain that escalated from the CoreGraphics vulnerability to full kernel-level control, affecting the entire device.
Exploit Maturity
Active Exploitation — State-Sponsored: CVE-2021-30860 is one of the most sophisticated exploits ever discovered in consumer software. It was actively exploited by NSO Group's Pegasus spyware, which was deployed by multiple nation-state customers to target journalists, human rights activists, lawyers, politicians, and government officials across dozens of countries. CISA added this vulnerability to the KEV catalog on November 3, 2021, with an accelerated remediation deadline of November 17, 2021.
Zero-Click Exploit: The FORCEDENTRY exploit is a zero-click attack — the victim does not need to open a file, click a link, or take any action. The malicious PDF containing the JBIG2 exploit payload was delivered via iMessage. Simply receiving the message was sufficient to trigger exploitation. The exploit used a novel technique of constructing a virtual CPU architecture within JBIG2 logical operators to achieve Turing-complete computation within the image decoder.
Discovery: The exploit was discovered by researchers at Citizen Lab at the University of Toronto in September 2021, who found it on the phone of a Saudi activist. Google's Project Zero subsequently published a detailed technical analysis calling it one of the most technically sophisticated exploits they had ever analyzed.
Ransomware Association: CISA's KEV catalog does not indicate a ransomware association. The exploitation was exclusively associated with targeted surveillance operations.
EPSS Context: The EPSS score of 0.72863 (98.76th percentile) places this vulnerability in the top 1.2% of all CVEs for exploitation probability, consistent with the confirmed state-sponsored exploitation and the extreme sophistication of the FORCEDENTRY attack.
Remediation
-
Update all Apple devices immediately. Install iOS 14.8, iPadOS 14.8, macOS Big Sur 11.6, Security Update 2021-005 Catalina, and watchOS 7.6.2 or later versions. Given the zero-click nature of FORCEDENTRY, no user action is needed to be exploited — simply having an unpatched device connected to a network is sufficient.
-
Enable automatic updates on all Apple devices. Configure iOS, iPadOS, macOS, and watchOS devices to install security updates automatically. This ensures rapid deployment of future patches for similar zero-click vulnerabilities.
-
Enable Apple Lockdown Mode for high-risk users. Apple introduced Lockdown Mode in iOS 16 and macOS Ventura specifically in response to sophisticated targeted attacks like FORCEDENTRY. Enable Lockdown Mode for journalists, activists, government officials, and other individuals at elevated risk of state-sponsored surveillance.
-
Audit devices for indicators of Pegasus compromise. Use the Mobile Verification Toolkit (MVT) developed by Amnesty International to scan iOS and Android devices for indicators of Pegasus infection. MVT analyzes device backups for known Pegasus artifacts and exploitation indicators.
-
Implement enterprise mobile device management (MDM). Use MDM solutions to enforce minimum OS version requirements, verify patch compliance across the organization, and restrict iMessage and other messaging platforms on devices handling sensitive communications if immediate patching is not feasible.
-
Monitor for emerging zero-click threats. Subscribe to security advisories from Apple, Citizen Lab, and CISA. Zero-click exploits targeting messaging platforms represent an evolving threat landscape that requires continuous vigilance and rapid patching cycles.
Technical Details
CVE-2021-30860 is an integer overflow vulnerability in Apple's CoreGraphics framework, specifically in the JBIG2 image decoder used for processing PDF files. JBIG2 is a compression standard (ITU T.88) designed for efficient encoding of bi-level (black and white) images, widely used in scanned document compression.
The vulnerability exists in the code path that processes JBIG2 segment data within PDF streams. When the JBIG2 decoder processes specially crafted segment headers, an integer overflow occurs in the calculation of buffer sizes required for storing decoded image data. The overflowed size value results in a smaller-than-expected memory allocation, creating a heap buffer overflow condition when the decoder subsequently writes decoded image data into the undersized buffer.
The FORCEDENTRY exploit developed by NSO Group represents an unprecedented level of exploitation sophistication. Rather than using the buffer overflow for a simple code execution chain, the exploit constructs an entire virtual computing environment within the JBIG2 decoder. JBIG2 supports logical operations (AND, OR, XOR, XNOR) on memory regions for combining image segments. The exploit uses approximately 70,000 JBIG2 segment commands that define logical operations on bitmap memory to implement a small virtual CPU architecture. This virtual CPU includes registers, a full 64-bit adder and comparator, and the ability to search memory and perform arbitrary computations. The exploit uses this virtual machine to bootstrap the exploitation chain, escape the initial sandbox, and achieve kernel-level code execution.
The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) technically requires local access and user interaction. However, the iMessage delivery mechanism transforms this into an effective remote zero-click exploit because iMessage automatically processes incoming attachments including PDF content. The attack chain exploits this automatic processing to achieve code execution without any victim interaction.
Apple addressed the vulnerability with improved input validation in the JBIG2 decoder to prevent the integer overflow condition. The fix was released on September 13, 2021, just days after Citizen Lab's disclosure.
Frequently Asked Questions
Is CVE-2021-30860 being actively exploited?
Yes. CVE-2021-30860 was actively exploited by NSO Group's Pegasus spyware in targeted attacks against journalists, activists, and government officials worldwide. Known as FORCEDENTRY, this exploit was a zero-click attack delivered via iMessage that required no victim interaction. CISA added it to the KEV catalog on November 3, 2021, with an urgent remediation deadline of November 17, 2021.
What products are affected by CVE-2021-30860?
CVE-2021-30860 affects Apple iOS before 14.8, iPadOS before 14.8, macOS (Big Sur before 11.6 and Catalina before Security Update 2021-005), watchOS before 7.6.2, and also non-Apple software that uses affected PDF rendering libraries including Xpdf before 4.04 and Poppler before 22.09.0.
How do I fix CVE-2021-30860?
Update immediately to iOS 14.8+, iPadOS 14.8+, macOS Big Sur 11.6+, Security Update 2021-005 Catalina, or watchOS 7.6.2+. For high-risk individuals, enable Apple Lockdown Mode (available in iOS 16+ and macOS Ventura+). Use the Mobile Verification Toolkit (MVT) to check devices for indicators of prior Pegasus compromise.
How severe is CVE-2021-30860?
CVE-2021-30860 is rated HIGH with a CVSS score of 7.8, but its real-world severity is exceptional due to the zero-click exploitation method. The FORCEDENTRY exploit required no victim interaction — merely receiving an iMessage was sufficient for complete device compromise. Google's Project Zero described it as one of the most technically sophisticated exploits ever analyzed. The EPSS score of 0.72863 (98.76th percentile) confirms an extremely high exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.