CVE-2021-30860: Apple Multiple Products Integer Overflow Vulnerability

High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 76% chance of exploitation in the next 30 days.

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Affected products

• Apple iPadOS: before 14.8 (fixed in 14.8)
• Apple iPhone OS: before 12.5.5 (fixed in 12.5.5); from 13.0, before 14.8 (fixed in 14.8)
• Apple Mac OS X: from 10.15, before 10.15.7 (fixed in 10.15.7); version 10.15.7 only
• Apple macOS: before 11.6 (fixed in 11.6)
• Apple watchOS: before 7.6.2 (fixed in 7.6.2)
• Freedesktop Poppler: before 22.09.0 (fixed in 22.09.0)
• Xpdfreader Xpdf: before 4.04 (fixed in 4.04)

Published 2021-08-24. Last modified 2026-06-17.