{"id":"CVE-2021-30860","aliases":["EUVD-2021-17777","JLSEC-2025-195"],"status":"published","title":"An integer overflow was addressed with improved input validation","description":"An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.75994,"percentile":0.99535,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-190","CWE-20"],"published":"2021-08-24T18:49:25Z","modified":"2026-10-24T10:30:31Z","kev":{"date_added":"2021-11-03","due_date":"2021-11-17","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"pocgithub","id":"Levilutz/CVE-2021-30860","title":"Levilutz/CVE-2021-30860","date":"2021-09-18","url":"https://github.com/Levilutz/CVE-2021-30860"},{"source":"pocgithub","id":"jeffssh/CVE-2021-30860","title":"jeffssh/CVE-2021-30860","date":"2021-12-25","url":"https://github.com/jeffssh/CVE-2021-30860"}],"fixes":[{"ecosystem":"Julia","package":"Poppler_jll","fixed_in":["23.12.0+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Julia","package":"Poppler_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"23.12.0+0"}]}]}],"products":[{"vendor":"apple","product":"ios"},{"vendor":"apple","product":"ipados"},{"vendor":"apple","product":"iphone_os"},{"vendor":"apple","product":"mac_os_x"},{"vendor":"apple","product":"macos"},{"vendor":"apple","product":"multiple products"},{"vendor":"apple","product":"watchos"},{"vendor":"cisco","product":"ios"},{"vendor":"freedesktop","product":"poppler"},{"vendor":"xpdfreader","product":"xpdf"}],"references":[{"url":"https://support.apple.com/en-us/HT212804","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://support.apple.com/en-us/HT212805","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://support.apple.com/en-us/HT212807","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://support.apple.com/en-us/HT212806","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/28","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/27","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/25","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/26","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/40","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/38","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/39","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://support.apple.com/kb/HT212824","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/50","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/02/11","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"https://security.gentoo.org/glsa/202209-21","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30860","tags":["government-resource","US Government Resource","web"]}],"sources":{"cve":[{"id":"CVE-2021-30860","description":"An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.","status":"published","published":"2021-08-24T18:49:25Z","modified":"2025-10-21T23:25:37.148Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:33:02.20241Z"}],"euvd":[{"id":"EUVD-2021-17777","description":"An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.","status":"published","published":"2021-08-24T18:49:25Z","modified":"2025-10-21T23:25:37Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T20:31:25.901288Z"}],"kev":[{"id":"CVE-2021-30860","title":"Apple Multiple Products Integer Overflow Vulnerability","description":"Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY.","cwes":["CWE-20","CWE-190"],"kev":{"date_added":"2021-11-03","due_date":"2021-11-17","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2021-30860","description":"An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.","status":"published","published":"2021-08-24T19:15:14.37Z","modified":"2026-06-17T03:51:01.843Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:06:57.318236Z"}],"osv":[{"id":"CVE-2021-30860","description":"An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.","status":"published","published":"2021-08-24T19:15:14.37Z","modified":"2026-10-24T10:30:31.922699956Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"JLSEC-2025-195","title":"An integer overflow was addressed with improved input validation","description":"An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.","status":"published","published":"2025-10-28T13:50:46.694Z","modified":"2026-07-18T00:00:21.571692867Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"}]}}