ZeroDay Findings
Sign inSign up

Findings

CVE-2021-31010

Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability

Published Aug 24, 2021 · updated Jun 16, 2026 · apple ipados

A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..

Timeline

Detection, updates, and resolution for this record.

  1. Aug 24, 2021 · Catalog

    Detected

    A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..

  2. Aug 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Sep 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..

Required action

Apply updates per vendor instructions.

CISA due date Sep 15, 2022

Affected

  • cpe apple/ipadosversion unspecified
  • cpe apple/iphone osversion unspecified
  • cpe apple/mac os xversion unspecified
  • cpe apple/mac os x10.15.7
  • vendor Apple iOS, macOS, watchOSversion unspecified

Sources

  • CISA KEVCVE-2021-31010

    In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions.

    cisa.gov
  • CVE.orgCVE-2021-31010

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-31010

    30-day exploitation probability 3.7%

    first.org
  • NIST NVDCVE-2021-31010

    A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was awar

    nvd.nist.gov

References

CVE-2021-31010 · ZeroDay Findings