Technical intelligence and weaponization dossier for CVE-2021-30860. Documented exploitation across 1 active malware families totaling 10 analyzed telemetry samples.
| Vulnerability ID | CVE-2021-30860 |
|---|---|
| Common Name / Bulletin | Apple CoreGraphics / ImageIO FORCEDENTRY Zero-Click PDF Parsing RCE (Pegasus Spyware) (Apple Security Advisory HT212807) |
| CWE Classification | CWE-190: Integer Overflow or Wraparound in JBIG2 Decoder |
| Affected Software & Versions | iOS before 14.8, macOS Big Sur before 11.6, watchOS before 7.6.2 |
| Technical Root Cause | Integer overflow in the Apple CoreGraphics framework when parsing malformed JBIG2 stream objects embedded within PDF/PSD files transmitted via iMessage. Exploited by NSO Group's FORCEDENTRY exploit chain to achieve zero-click arbitrary code execution without victim interaction. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2021-30860 in enterprise networks:
IMTransferAgent or imagent process crashes on iOS/macOS followed by sudden background daemon launches from /private/var/tmp.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: InfoStealer Protection & Remediation →