HIGH🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2021-30860

CVSS 7.8v3.1pub. 2021-08-24upd. 2025-10-27

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Apple iPadOS
OS
Apple
< 14.8
Apple iOS
OS
Apple
< 12.5.513.0 – 14.8 (bez)
Apple macOS
OS
Apple
< 11.6
Apple Mac Os X
OS
Apple
10.15.710.15 – 10.15.7 (bez)
Apple watchOS
OS
Apple
< 7.6.2
Freedesktop Poppler
APP
Freedesktop
< 22.09.0
Xpdfreader Xpdf
APP
Xpdfreader
< 4.04

CISA KEV — detailsi

Vendori: Apple ↗
Producti: Multiple Products
Added to KEVi: November 3, 2021
Remediation deadline (US Federal)i: November 17, 2021(overdue)

🔧Advisory Apple↗🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY.

🔴