CVE-2021-31010

A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://support.apple.com/en-us/HT212804	Vendor Advisory
https://support.apple.com/en-us/HT212805	Vendor Advisory
https://support.apple.com/en-us/HT212806	Vendor Advisory
https://support.apple.com/en-us/HT212807	Vendor Advisory
https://support.apple.com/en-us/HT212824	Vendor Advisory
https://support.apple.com/en-us/HT212804	Vendor Advisory
https://support.apple.com/en-us/HT212805	Vendor Advisory
https://support.apple.com/en-us/HT212806	Vendor Advisory
https://support.apple.com/en-us/HT212807	Vendor Advisory
https://support.apple.com/en-us/HT212824	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31010	US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:mac_os_x::::::::
	cpe:2.3:o:apple:mac_os_x:10.15.7:-::::::
	cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020::::::
	cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001::::::
	cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-005::::::
	cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-007::::::
	cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001::::::
	cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002::::::
	cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003::::::
	cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-006::::::
	cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-007::::::
	cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-008::::::
	cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-001::::::
	cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-002::::::
	cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-003::::::
	cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-004::::::
	cpe:2.3:o:apple:mac_os_x:10.15.7:supplemental_update::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:watchos::::::::

History

23 Oct 2025, 18:01

Type	Values Removed	Values Added
References	~~() https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31010 -~~	() https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31010 - US Government Resource

22 Oct 2025, 00:17

Type	Values Removed	Values Added
References		() https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31010 -

21 Oct 2025, 20:18

Type	Values Removed	Values Added
References	~~{'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31010', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}~~

21 Oct 2025, 19:19

Type	Values Removed	Values Added
References		() https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31010 -

21 Nov 2024, 06:05

Type	Values Removed	Values Added
References	~~() https://support.apple.com/en-us/HT212804 - Vendor Advisory~~	() https://support.apple.com/en-us/HT212804 - Vendor Advisory
References	~~() https://support.apple.com/en-us/HT212805 - Vendor Advisory~~	() https://support.apple.com/en-us/HT212805 - Vendor Advisory
References	~~() https://support.apple.com/en-us/HT212806 - Vendor Advisory~~	() https://support.apple.com/en-us/HT212806 - Vendor Advisory
References	~~() https://support.apple.com/en-us/HT212807 - Vendor Advisory~~	() https://support.apple.com/en-us/HT212807 - Vendor Advisory
References	~~() https://support.apple.com/en-us/HT212824 - Vendor Advisory~~	() https://support.apple.com/en-us/HT212824 - Vendor Advisory

28 Jun 2024, 14:07

Type	Values Removed	Values Added
References	~~() https://support.apple.com/en-us/HT212804 -~~	() https://support.apple.com/en-us/HT212804 - Vendor Advisory
References	~~() https://support.apple.com/en-us/HT212805 -~~	() https://support.apple.com/en-us/HT212805 - Vendor Advisory
References	~~() https://support.apple.com/en-us/HT212806 -~~	() https://support.apple.com/en-us/HT212806 - Vendor Advisory
References	~~() https://support.apple.com/en-us/HT212807 -~~	() https://support.apple.com/en-us/HT212807 - Vendor Advisory
References	~~() https://support.apple.com/en-us/HT212824 -~~	() https://support.apple.com/en-us/HT212824 - Vendor Advisory

31 May 2022, 20:13

Type	Values Removed	Values Added
CPE		cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-006:::::: cpe:2.3:o:apple:mac_os_x:10.15.7:supplemental_update:::::: cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-005:::::: cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:::::: cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-002:::::: cpe:2.3:o:apple:mac_os_x:::::::: cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-008:::::: cpe:2.3:o:apple:watchos:::::::: cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-007:::::: cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:::::: cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-003:::::: cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020:::::: cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-004:::::: cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-007:::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:mac_os_x:10.15.7:-:::::: cpe:2.3:o:apple:ipad_os:::::::: cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-001:::::: cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001::::::
CWE		CWE-502
References	~~(MISC) https://support.apple.com/en-us/HT212824 -~~	(MISC) https://support.apple.com/en-us/HT212824 - Vendor Advisory
References	~~(MISC) https://support.apple.com/en-us/HT212806 -~~	(MISC) https://support.apple.com/en-us/HT212806 - Vendor Advisory
References	~~(MISC) https://support.apple.com/en-us/HT212804 -~~	(MISC) https://support.apple.com/en-us/HT212804 - Vendor Advisory
References	~~(MISC) https://support.apple.com/en-us/HT212805 -~~	(MISC) https://support.apple.com/en-us/HT212805 - Vendor Advisory
References	~~(MISC) https://support.apple.com/en-us/HT212807 -~~	(MISC) https://support.apple.com/en-us/HT212807 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 5.0 v3 : 7.5

26 May 2022, 18:15

Type	Values Removed	Values Added
Summary	REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none.	A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..
References		(MISC) https://support.apple.com/en-us/HT212806 - (MISC) https://support.apple.com/en-us/HT212804 - (MISC) https://support.apple.com/en-us/HT212807 - (MISC) https://support.apple.com/en-us/HT212805 - (MISC) https://support.apple.com/en-us/HT212824 -

24 Aug 2021, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-08-24 19:15

Updated : 2025-10-23 18:01

NVD link : CVE-2021-31010

Mitre link : CVE-2021-31010

CVE.ORG link : CVE-2021-31010

JSON object : View

Products Affected

apple

mac_os_x
ipados
macos
watchos
iphone_os

CWE

CWE-502

Deserialization of Untrusted Data

7.5 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0 /10

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

JSON object

Attach tags to CVE-2021-31010

7.5^/10

5.0^/10

Attach tags to `CVE-2021-31010`