Apple Patches FORCEDENTRY Zero-Day Vulnerability

The FORCEDENTRY zero-day vulnerability (CVE-2021-30860) has been actively exploited to deliver Pegasus spyware, developed by NSO Group, through iMessage. The attack requires no user interaction and targets Apple’s CoreGraphics image rendering library by processing a malicious PDF file disguised with a “.gif” extension, leading to arbitrary code execution. The advisory also mentions CVE-2021-30858, another arbitrary code execution vulnerability that Apple reported may have been actively exploited.