Actively exploited in the wild
Apple Multiple Products Integer Overflow Vulnerability
Apple - Multiple Products · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-30860
HighCVSS 7.8KEVSummary
An integer overflow issue in Apple systems, fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, and watchOS 7.6.2, may lead to arbitrary code execution when processing a maliciously crafted PDF. Apple is aware of active exploitation.
Risk Assessment
An attacker could remotely execute arbitrary code on the victim's device, potentially leading to full system compromise or data theft.
Recommendation
Update the operating system to a version containing the fix to mitigate the vulnerability.
Other vulnerabilities in Apple operating systems
See all- CVE-2023-40403Medium
The issue was addressed with improved memory handling. It is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information.
- CVE-2026-64774Critical
An integer overflow vulnerability was addressed with improved input validation. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64772Critical
An out-of-bounds write issue was addressed with improved input validation. Affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64771Critical
A buffer overflow vulnerability was addressed with improved bounds checking. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64770Critical
An out-of-bounds write issue was addressed with improved bounds checking. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64769Critical
An out-of-bounds write issue was addressed with improved bounds checking. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64746Critical
An authorization issue was addressed with improved validation. Affects iOS, iPadOS, macOS, visionOS, and watchOS. An app may add contacts without user authorization.
- CVE-2026-64726Critical
The issue was addressed with improved memory handling. Affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An attacker in physical proximity may corrupt process memory.
- CVE-2026-43812Critical
A use after free issue was addressed with improved memory management. Affects iOS, iPadOS, macOS, tvOS, and visionOS. An app may cause unexpected system termination.
- CVE-2026-43809Critical
An out-of-bounds read was addressed with improved bounds checking. Affects iOS, iPadOS, macOS. An app may cause unexpected system termination.
Original NVD description (English source)
An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.