CVE-2021-30860: Apple Multiple Products Integer Overflow Vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2021-11-03
EPSS: 76.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-24 · updated 2026-06-17
Weakness: CWE-190

Description

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Affected products

Apple iPadOS: before 14.8 — fixed in 14.8
Apple Iphone Os: before 12.5.5; from 13.0 before 14.8 — fixed in 12.5.5, 14.8
macOS: from 10.15 before 10.15.7; 10.15.7, 10.15.7-security_update_2020, 10.15.7-security_update_2020-001, 10.15.7-security_update_2021-001, 10.15.7-security_update_2021-002, 10.15.7-security_update_2021-003 (+1) — fixed in 10.15.7
Apple macOS: before 11.6 — fixed in 11.6
Apple watchOS: before 7.6.2 — fixed in 7.6.2
poppler: before 22.09.0 — fixed in 22.09.0
Xpdf: before 4.04 — fixed in 4.04

How to fix

Upgrade to a fixed version: Apple iPadOS 14.8; Apple Iphone Os 12.5.5, 14.8; macOS 10.15.7; Apple macOS 11.6; Apple watchOS 7.6.2; poppler 22.09.0; Xpdf 4.04. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-30860 or the next vulnerability affects your stack