# CVE-2021-31010

A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..

- Page: https://www.vulneraibility.com/cve/CVE-2021-31010
- CVSS: 7.5
- Known exploited: yes, in CISA KEV since 2022-08-25; CISA due date 2022-09-15
- EPSS: 3.67% (percentile 89.8)
- CISA SSVC: exploitation active, automatable yes, technical impact partial (assessed 2025-01-29)
- Weakness: CWE-502
- Published: 2021-08-24

## Affected versions

- Apple macOS: affected < 11.6; < 2021
- Apple watchOS: affected < 7.6; < 14.8; < 12.5

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://support.apple.com/en-us/HT212804
- [other] https://support.apple.com/en-us/HT212805
- [other] https://support.apple.com/en-us/HT212807
- [other] https://support.apple.com/en-us/HT212806
- [other] https://support.apple.com/en-us/HT212824
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31010

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.