Apple iOS, iPadOS, macOS, watchOS Integer Overflow Remote Code Execution Vulnerability (CVE-2021-30860, FORCEDENTRY)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-30860, widely known as FORCEDENTRY) is an integer overflow vulnerability (CWE-190) residing within Apple's CoreGraphics framework, specifically during the parsing of PDF and image files. Due to insufficient input validation, processing a maliciously crafted PDF document causes an integer overflow when calculating memory allocation sizes for specific data streams. This leads to a heap-based buffer overflow, resulting in memory corruption and arbitrary code execution.

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by constructing a highly specialized PDF or image file that abuses the JBIG2 compression standard decoder implementation within CoreGraphics. When this file is transmitted via messaging applications like iMessage that automatically render attachments, the vulnerability is triggered in the background without requiring any user interaction (Zero-Click). The integer overflow occurs during the decoding loop, allowing the attacker to bypass the sandbox, overwrite memory boundaries, and execute arbitrary shellcode with system privileges.

3. Infrastructure & Business Impact

This vulnerability has been actively exploited in the wild as a zero-day exploit targeting high-profile individuals. It is cataloged in the CISA KEV list and carries a high EPSS score of 0.7599, indicating an extremely high probability of exploitation. Successful exploitation allows threat actors to gain unauthorized access to sensitive endpoint data, including microphones, cameras, GPS locations, and corporate communications, posing a severe threat to enterprise confidentiality and infrastructure integrity.