{"id":"CVE-2021-31010","aliases":["EUVD-2021-17927"],"status":"published","title":"Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability","description":"A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03673,"percentile":0.89755,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-502"],"published":"2021-08-24T18:51:48Z","modified":"2026-06-17T03:51:18Z","kev":{"date_added":"2022-08-25","due_date":"2022-09-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-08-25"},{"source":"kev","since":"2022-08-25"}],"products":[{"vendor":"apple","product":"ios, macos, watchos"},{"vendor":"apple","product":"ipados"},{"vendor":"apple","product":"iphone_os"},{"vendor":"apple","product":"mac_os_x"},{"vendor":"apple","product":"macos"},{"vendor":"apple","product":"watchos"}],"references":[{"url":"https://support.apple.com/en-us/HT212804","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212805","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212807","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212806","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212824","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31010","tags":["government-resource","US Government Resource"]}],"sources":{"cve":[{"id":"CVE-2021-31010","description":"A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..","status":"published","published":"2021-08-24T18:51:48Z","modified":"2025-10-21T23:25:36.283Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:33:05.665371Z"}],"euvd":[{"id":"EUVD-2021-17927","description":"A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..","status":"published","published":"2021-08-24T18:51:48Z","modified":"2025-10-21T23:25:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"exploited_since":"2022-08-25","updated_at":"2026-11-02T20:31:25.901288Z"}],"kev":[{"id":"CVE-2021-31010","title":"Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability","description":"In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions.","cwes":["CWE-20","CWE-502"],"kev":{"date_added":"2022-08-25","due_date":"2022-09-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2021-31010","description":"A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..","status":"published","published":"2021-08-24T19:15:24.967Z","modified":"2026-06-17T03:51:18.307Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:06:57.67549Z"}]}}