{"schemaVersion":3,"id":"CVE-2021-30860","aliases":[],"status":"published","duplicateOf":null,"title":"Apple Multiple Products Integer Overflow Vulnerability","description":"An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.","dates":{"published":"2021-08-24T18:49:25.000Z","modified":"2025-10-21T23:25:37.148Z","reserved":null,"kevAdded":["2021-11-03T00:00:00.000Z"],"kevDue":["2021-11-17T00:00:00.000Z"]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.75994,"percentile":0.99527,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.75994},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.75994,"percentile":0.99527}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.75994,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.75994,"percentile":0.99527}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2021-11-17T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Apple Multiple Products Integer Overflow Vulnerability","description":"Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2021-30860","label":"nvd.nist.gov/vuln/detail/CVE-2021-30860"}],"vendor":"Apple","product":"Multiple Products","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2021-11-17T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Apple Multiple Products Integer Overflow Vulnerability","description":"Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2021-30860","label":"nvd.nist.gov/vuln/detail/CVE-2021-30860"}],"vendor":"Apple","product":"Multiple Products","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-190","name":"Integer Overflow or Wraparound","description":"The product performs a calculation that can\n         produce an integer overflow or wraparound when the logic\n         assumes that the resulting value will always be larger than\n         the original value. This occurs when an integer value is\n         incremented to a value that is too large to store in the\n         associated representation. When this occurs, the value may\n         become a very small or negative number.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/190.html"}],"affected":[{"vendor":"apple","product":"ios","name":"iOS","label":"ios","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 14.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 14.8","eol":null,"hubHref":"/vendor/apple/ios"},{"vendor":"apple","product":"ipados","name":"ipados","label":"ipados","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 14.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 14.8","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"ipados","label":"Apple iPadOS","category":"os"}},"hubHref":"/vendor/apple/ipados"},{"vendor":"apple","product":"iphone_os","name":"iphone os","label":"iphone_os","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 12.5.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 13.0, < 14.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.5.5 | ≥ 13.0, < 14.8","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"ios","label":"Apple iOS","category":"os"}},"hubHref":"/vendor/apple/iphone_os"},{"vendor":"apple","product":"mac_os_x","name":"mac os x","label":"mac_os_x","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 10.15, < 10.15.7","noFixRecorded":false,"fixedIn":null},{"text":"10.15.7","noFixRecorded":false,"fixedIn":null},{"text":"10.15.7:security_update_2020","noFixRecorded":false,"fixedIn":null},{"text":"10.15.7:security_update_2020-001","noFixRecorded":false,"fixedIn":null},{"text":"10.15.7:security_update_2021-001","noFixRecorded":false,"fixedIn":null},{"text":"10.15.7:security_update_2021-002","noFixRecorded":false,"fixedIn":null},{"text":"10.15.7:security_update_2021-003","noFixRecorded":false,"fixedIn":null},{"text":"10.15.7:security_update_2021-004","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 10.15, < 10.15.7 | 10.15.7 | 10.15.7:security_update_2020 | 10.15.7:security_update_2020-001 | 10.15.7:security_update_2021-001 | 10.15.7:security_update_2021-002 | 10.15.7:security_update_2021-003 | 10.15.7:security_update_2021-004","eol":null,"hubHref":"/vendor/apple/mac_os_x"},{"vendor":"apple","product":"macos","name":"macos","label":"macos","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 11.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ unspecified, < 2021-005","noFixRecorded":false,"fixedIn":null},{"text":"< 11.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 11.6 | ≥ unspecified, < 2021-005 | < 11.6","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"macos","label":"Apple macOS","category":"os"}},"hubHref":"/vendor/apple/macos"},{"vendor":"apple","product":"watchos","name":"watchos","label":"watchos","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 7.6","noFixRecorded":false,"fixedIn":null},{"text":"< 7.6.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 7.6 | < 7.6.2","eol":null,"hubHref":"/vendor/apple/watchos"},{"vendor":"freedesktop","product":"poppler","name":"poppler","label":"poppler","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 22.09.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 22.09.0","eol":null,"hubHref":"/vendor/freedesktop/poppler"},{"vendor":"xpdfreader","product":"xpdf","name":"xpdf","label":"xpdf","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 4.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.04","eol":null,"hubHref":"/vendor/xpdfreader/xpdf"}],"affectedCount":8,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://support.apple.com/en-us/HT212804","label":"support.apple.com/en-us/HT212804","hostname":"support.apple.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212805","label":"support.apple.com/en-us/HT212805","hostname":"support.apple.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212807","label":"support.apple.com/en-us/HT212807","hostname":"support.apple.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212806","label":"support.apple.com/en-us/HT212806","hostname":"support.apple.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/28","label":"seclists.org/fulldisclosure/2021/Sep/28","hostname":"seclists.org","tags":["Mailing List","X Refsource FULLDISC","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/27","label":"seclists.org/fulldisclosure/2021/Sep/27","hostname":"seclists.org","tags":["Mailing List","X Refsource FULLDISC","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/25","label":"seclists.org/fulldisclosure/2021/Sep/25","hostname":"seclists.org","tags":["Mailing List","X Refsource FULLDISC","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/26","label":"seclists.org/fulldisclosure/2021/Sep/26","hostname":"seclists.org","tags":["Mailing List","X Refsource FULLDISC","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/40","label":"seclists.org/fulldisclosure/2021/Sep/40","hostname":"seclists.org","tags":["Mailing List","X Refsource FULLDISC","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/38","label":"seclists.org/fulldisclosure/2021/Sep/38","hostname":"seclists.org","tags":["Mailing List","X Refsource FULLDISC","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/39","label":"seclists.org/fulldisclosure/2021/Sep/39","hostname":"seclists.org","tags":["Mailing List","X Refsource FULLDISC","Third Party Advisory"]},{"url":"https://support.apple.com/kb/HT212824","label":"support.apple.com/kb/HT212824","hostname":"support.apple.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/50","label":"seclists.org/fulldisclosure/2021/Sep/50","hostname":"seclists.org","tags":["Mailing List","X Refsource FULLDISC","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/02/11","label":"www.openwall.com/lists/oss-security/2022/09/02/11","hostname":"www.openwall.com","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://security.gentoo.org/glsa/202209-21","label":"security.gentoo.org/glsa/202209-21","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30860","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30860","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2021-08-24T18:49:25.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2021-11-03T00:00:00.000Z","label":"Added to CISA KEV","detail":"Apple Multiple Products Integer Overflow Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2021-11-17T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:25:37.148Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T06:51:29.358Z","stale":false,"partial":false}}