7.5

CVE-2021-31010: Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability

CVSS: 7.5v3.1HighKEVAnalyzed
Published 24-08-2021Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2021-31010 is a high (CVSS 7.5) Deserialization of Untrusted Data vulnerability in Apple iOS, macOS, watchOS. It is known to be exploited: CISA lists it, first on 25-08-2022. EPSS estimates a 3.67% chance of exploitation in the next 30 days, higher than 89.5% of scored vulnerabilities.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
3.67%
0%100%
Low · 0.00 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 24-08-2021
    PublishedVulnerability first disclosed.
  2. 25-08-2022
    Added to CISA KEVApple iOS, macOS, watchOS Sandbox Bypass Vulnerability
  3. 15-09-2022
    CISA remediation dueApply updates per vendor instructions.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

3.67%

Chance of exploitation in the next 30 days

Percentile

90%

Versus all other CVEs

30-day change

0.00 pp

From 3.67% on 21-09-2026

21-09-202621-10-2026
EPSS score
3.67%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
25-08-2022
Federal due date
15-09-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2021-31010

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Apple5 products
  • ipados< 14.8
  • iphone_os≥ 12.0, < 12.5.5 | ≥ 14.0, < 14.8
  • mac_os_x≥ 10.15, < 10.15.7 | 10.15.7 | 10.15.7:security_update_2020 | 10.15.7:security_update_2020-001 | 10.15.7:security_update_2020-005 | 10.15.7:security_update_2020-007 | 10.15.7:security_update_2021-001 | 10.15.7:security_update_2021-002 | 10.15.7:security_update_2021-003 | 10.15.7:security_update_2021-006 | 10.15.7:security_update_2021-007 | 10.15.7:security_update_2021-008 | 10.15.7:security_update_2022-001 | 10.15.7:security_update_2022-002 | 10.15.7:security_update_2022-003 | 10.15.7:security_update_2022-004 | 10.15.7:supplemental_update
  • macos≥ unspecified, < 11.6 | ≥ unspecified, < 2021 | ≥ 11.0, < 11.6
  • watchos≥ unspecified, < 7.6 | ≥ unspecified, < 14.8 | ≥ unspecified, < 12.5 | < 7.6.2

1 vendor · 5 products

References

6 links