Skip to main content
عربي
logo

NCSC-TAD-2109-004

Severity Level: Critical
Vulnerability

Reference No.: NCSC-TAD-2109-004CVSS 0

Apple Patches FORCEDENTRY Zero-Day Vulnerability

Threat Type:
N/A
TLP:
CLEAR
CVE:
CVE-2021-30860, CVE-2021-30858

Overview

The FORCEDENTRY zero-day vulnerability (CVE-2021-30860) has been actively exploited to deliver Pegasus spyware, developed by NSO Group, through iMessage. The attack requires no user interaction and targets Apple’s CoreGraphics image rendering library by processing a malicious PDF file disguised with a “.gif” extension, leading to arbitrary code execution. The advisory also mentions CVE-2021-30858, another arbitrary code execution vulnerability that Apple reported may have been actively exploited.

Affected Technologies

  • iPhones
  • Mac computers
  • Apple Watches

Mitigation and Immediate Actions

  1. 01

    Update all Apple devices to the latest version immediately.

References