CVE-2021-31010

CVE-2021-31010 is a high-severity (CVSS 7.5) vulnerability in Apple iOS, macOS, watchOS. CISA added it to the Known Exploited Vulnerabilities catalog on August 25, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 15, 2022. CISA does not currently list it as used in ransomware campaigns. Apple has 96 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

• https://support.apple.com/en-us/HT212804
• https://support.apple.com/en-us/HT212805
• https://support.apple.com/en-us/HT212806
• https://support.apple.com/en-us/HT212807
• https://support.apple.com/en-us/HT212824
• https://support.apple.com/en-us/HT212804
• https://support.apple.com/en-us/HT212805
• https://support.apple.com/en-us/HT212806