Loading story…
Apple fixed CVE-2021-30860, an integer-overflow vulnerability in PDF processing that can permit arbitrary code execution when a device handles a maliciously crafted PDF. Apple said it was aware of reports that the flaw may have been exploited in the wild.
The company addressed the issue with improved input validation in iOS 14.8, iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2, and Security Update 2021-005 Catalina. Organizations should identify Apple devices below these releases and apply the applicable updates, prioritizing systems that process externally supplied PDF files.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2021-30860 was published as an integer-overflow vulnerability in Apple software. Processing a maliciously crafted PDF could allow arbitrary code execution, and Apple said it was aware of a report that the flaw may have been actively exploited.
Apple addressed CVE-2021-30860 through improved input validation in Security Update 2021-005 Catalina, macOS Big Sur 11.6, iOS and iPadOS 14.8, and watchOS 7.6.2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourcesupport.apple.com
Open sourcesupport.apple.com
Open sourcesupport.apple.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple released security updates for **CVE-2026-86950**, an out-of-bounds write vulnerability in CoreGraphics that can enable arbitrary code execution when a victim processes a maliciously crafted file. Apple said it is aware of reports that the issue may have been used in an “extremely sophisticated” targeted attack against specific individuals running iOS versions before iOS 27; it did not disclose the attackers, victim count, compromise details, or timing. The company fixed the flaw with improved bounds checking in **iOS 26.7.1**, **iPadOS 26.7.1**, **macOS Tahoe 26.7.1**, and **macOS Sequoia 15.8.1**, and credited Meta Product Security with reporting it. Organizations should prioritize deployment across supported Apple endpoints, particularly devices remaining on pre-iOS 27 releases, because exploitation requires only user processing of a malicious file and could result in full confidentiality, integrity, and availability impact.
Oct 1, 2026
Apple released macOS Big Sur 11.2 and Security Update 2021-001 for Catalina and Mojave to address numerous vulnerabilities affecting the kernel, WebKit, ImageIO, CoreText, CoreGraphics, CFNetwork, NetFSFramework, XNU, and other components. The flaws could enable denial of service, information disclosure, arbitrary code execution, and kernel-level compromise. Among the fixes, **CVE-2021-1782** is a race-condition flaw that allowed a malicious application to elevate privileges; Apple said it may have been actively exploited and corrected it through improved locking. Apple also reported potential in-the-wild exploitation of **CVE-2021-1764** in the Kernel and **CVE-2021-1789** in WebKit, underscoring the need to apply the available macOS security updates.
Aug 26, 2026
Apple issued security updates across its ecosystem to address **multiple vulnerabilities** affecting *iOS, iPadOS, macOS, tvOS, watchOS,* and *visionOS*, with impacts including **remote code execution (RCE)**, denial of service, elevation of privilege, information disclosure, data manipulation, and security restriction bypass. HKCERT highlighted **CVE-2026-20700** as a **high-risk** issue and noted it is **being exploited in the wild**; the flaw is described as an **improper restriction of operations within the bounds of a memory buffer** that could allow arbitrary code execution when an attacker has memory-write capability. Apple’s iOS 26.3 and iPadOS 26.3 security content includes fixes for issues that could expose sensitive information on a locked device (e.g., **CVE-2026-20645** and **CVE-2026-20674**) and a Bluetooth-related denial-of-service condition where a privileged network attacker could trigger DoS using crafted packets (**CVE-2026-20650**). The updates apply to **iPhone 11 and later** and a range of supported iPad models, and Apple reiterated its policy of publishing details after patches are available.
Jul 23, 2026