PT-2021-7371 · Apple · Ipados+4

Published 2021-08-24 · Updated 2025-10-23 · CVE-2021-31010

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 12.5.5 Apple iOS versions prior to 14.8 Apple iPadOS versions prior to 14.8 Apple macOS versions prior to 11.6 Apple watchOS versions prior to 7.6.2

Description A deserialization issue was addressed through improved validation, which may allow a sandboxed process to circumvent sandbox restrictions. This issue may have been actively exploited. The vulnerability is related to the Core Telephony framework and involves the recovery of invalid data in memory, potentially allowing a remote attacker to bypass security restrictions.

Recommendations For Apple iOS versions prior to 12.5.5, update to iOS 12.5.5 or later. For Apple iOS versions prior to 14.8, update to iOS 14.8 or later. For Apple iPadOS versions prior to 14.8, update to iPadOS 14.8 or later. For Apple macOS versions prior to 11.6, update to macOS 11.6 or later. For Apple watchOS versions prior to 7.6.2, update to watchOS 7.6.2 or later.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2022-05823

CVE-2021-31010

Affected Products

Core Telephony Framework

Apple Macos

Ios

Ipados

Watchos

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2021-31010 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31010 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05823 · Security Note
• https://t.me/cvenotify/30934 · Telegram Post
• https://support.apple.com/en-us/HT212804 · Vendor Advisory, Security Note
• https://support.apple.com/en-us/HT212805 · Vendor Advisory, Security Note
• https://support.apple.com/en-us/103147 · Note
• https://support.apple.com/en-us/HT212806 · Vendor Advisory, Security Note
• https://support.apple.com/en-us/HT212807 · Vendor Advisory, Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://attackerkb.com/topics/OU0bUqzVxf/cve-2021-31010?referrer=activityFeed · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://modernmsp.io/what-your-msp-needs-to-know-about-ransomware-attacks-and-the-law · Note
• https://t.me/cveNotify/140065 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31010 · Note