CVE-2021-30860

Original summary

Normalized public record · Updated Oct 23, 2026

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Publisher and source text is retained separately from QFinch interpretation.

Affected products

Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.

Remediation

Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.

1. Confirm the affected product and reachable code path exist in your environment.
2. Apply the vendor-supported patch or mitigation from the primary advisory.
3. Rescan the exact deployed revision and retain verification evidence.

Evidence coverage

SSVC priority

IMMEDIATE

Confidence

50%

Aliases

None reported

Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.

Sources and record history

1. support.apple.com ↗
2. support.apple.com ↗
3. support.apple.com ↗
4. support.apple.com ↗
5. 20210917 APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina ↗
6. 20210917 APPLE-SA-2021-09-13-3 macOS Big Sur 11.6 ↗
7. 20210917 APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8 ↗
8. 20210917 APPLE-SA-2021-09-13-2 watchOS 7.6.2 ↗
9. 20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina ↗
10. 20210921 APPLE-SA-2021-09-20-6 Additional information for APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8 ↗
11. 20210921 APPLE-SA-2021-09-20-7 Additional information for APPLE-SA-2021-09-13-3 macOS Big Sur 11.6 ↗
12. support.apple.com ↗

Record history

Published Aug 24, 2021 · Last refreshed Oct 23, 2026