CVE-2021-31010: Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability

High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-08-25. EPSS: 3.7% chance of exploitation in the next 30 days.

A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..

Affected products

• Apple iPadOS: before 14.8 (fixed in 14.8)
• Apple iPhone OS: from 12.0, before 12.5.5 (fixed in 12.5.5); from 14.0, before 14.8 (fixed in 14.8)
• Apple Mac OS X: from 10.15, before 10.15.7 (fixed in 10.15.7); version 10.15.7 only
• Apple macOS: from 11.0, before 11.6 (fixed in 11.6)
• Apple watchOS: before 7.6.2 (fixed in 7.6.2)

Published 2021-08-24. Last modified 2026-06-17.