CVE-2021-30860 is an integer overflow vulnerability in Apple Multiple Products. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF.
What the vulnerability means in practice
CVE-2021-30860 is an integer overflow in Apple Multiple Products, specifically in CoreGraphics on iOS, iPadOS, macOS and watchOS, where processing a maliciously crafted PDF can lead to code execution. Integer overflows are dangerous because they can corrupt size calculations, shift memory boundaries, and turn document parsing into a code execution path.
For a reader assessing exposure, the key question is whether any of the affected Apple platforms are reachable by users who open or preview untrusted PDFs, including through email, messaging, browsers, document workflows, or shared files. For authoritative version and patch details, use the vendor advisory alongside the CVE Program and the NIST National Vulnerability Database.
Why this kind of flaw is dangerous
Integer overflow bugs in file parsers are high-risk because they are often triggered before any authentication boundary matters. A crafted document can reach a rendering or preview component through normal business activity, which makes the attack path simple and the blast radius broad when the vulnerable component is widely deployed.
This class of flaw is especially concerning in PDF handling because the file format is common, easy to deliver, and often processed automatically by client software and services. Once an attacker can influence parsing logic, they may be able to move from a harmless-looking document to arbitrary code execution, which is a major escalation from mere application crash or data corruption.
For weakness context, the CWE Top 25 Guide is useful because integer overflow appears among the software weakness classes that often underlie memory-safety exploitation.
How organisations assess exposure and reduce attack surface
Exposure review starts with inventory: identify Apple endpoints and any services that parse or preview PDFs on behalf of users, then confirm whether they are internet-facing, user-reachable, or exposed through shared content flows. Teams should not assume that only the primary workstation is relevant, because mail gateways, collaboration platforms, sync clients, and document viewers can all become delivery paths.
When remediation is not immediate, compensating controls should focus on reducing opportunities for untrusted PDF processing, tightening user interaction with unknown documents, and limiting where preview or rendering occurs. NHIMG’s Vulnerability Management Guide is a useful companion for prioritising KEV-listed issues, validating exposure, and measuring remediation progress.
Patch planning should be driven by the fact that CISA added the CVE to the KEV catalogue, which means active exploitation was already observed. That should move the issue ahead of routine backlog work and into urgent remediation and exception tracking.
Detection and post-exploitation review
Detection should look for evidence that a document-processing crash, unusual application termination, or unexpected code execution followed receipt or opening of a PDF. On managed fleets, review endpoint telemetry, application logs, and security tooling for anomalous process creation, persistence, or suspicious child processes originating from document viewers or preview helpers.
After patching, conduct a compromise review on systems that may have opened malicious PDFs before remediation. If exploitation occurred, rotate any credentials, session material, signing material, or service access that could have been exposed on the affected endpoint, because code execution on a user device can become a launch point for broader identity abuse.
For attacker tradecraft around exploitation chains and follow-on abuse, MITRE ATT&CK Enterprise Matrix is a practical reference for mapping suspicious post-exploitation behaviour.
Risk and Threat Considerations
Because this vulnerability was placed in CISA’s KEV catalogue, the main risk is not theoretical exposure but known real-world exploitation against a widely used document-processing path. The threat is strongest where users regularly receive untrusted PDFs and where patching lags behind active attacker use.
Failure mechanism: An attacker supplies a malicious PDF that triggers the integer overflow during CoreGraphics parsing, then uses the resulting code execution to run arbitrary code in the context of the victim process or user.
Impact: Successful exploitation can lead to device compromise, credential theft, lateral movement, and broader enterprise intrusion if the affected endpoint has access to sensitive applications, tokens, or data.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | CVE remediation requires timely correction of known software flaws. |
| SI-3 — Malicious Code Protection | Malicious PDFs are an input path that can deliver exploit content to endpoints. | |
| Recommendation — Prioritise SI-2 remediation for KEV-listed Apple flaws and track exception handling until patched. Strengthen SI-3 protections around untrusted document handling and inspect suspicious PDF payloads. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed exploitation makes prioritisation, inventory and remediation central to the subject. |
| CIS-10 — Malware Defenses | Exploit delivery through crafted files makes endpoint malware defence materially relevant. | |
| Recommendation — Use CIS-7 to inventory exposed Apple assets and accelerate remediation of the exploited flaw. Apply CIS-10 to block suspicious files, monitor endpoints and contain post-exploitation activity. | ||
| MITRE ATT&CK | T1204 — User Execution | The exploit depends on a user opening or previewing a malicious PDF. |
| Recommendation — Map malicious PDF delivery to T1204 and alert on document-open chains that precede compromise. | ||
Practitioner Guidance
Why practitioners should care: Treat KEV-listed document parser flaws as urgent exposure items, not generic application bugs. If affected Apple devices remain in service, ownership should sit with the patching and endpoint-security process, with clear escalation for exceptions that delay remediation.
What to watch for: Prioritise systems that routinely process external documents, then confirm whether user workflows make malicious PDF delivery plausible. If you cannot patch immediately, reduce exposure by constraining untrusted file handling and increasing monitoring around document-open events and unusual process activity.