CVE-2021-31010

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Apple	macOS	>= unspecified, < 11.6
Apple	macOS	>= unspecified, < 2021
Apple	watchOS	>= unspecified, < 7.6
Apple	watchOS	>= unspecified, < 14.8
Apple	watchOS	>= unspecified, < 12.5

References

https://support.apple.com/en-us/HT212804Vendor Advisory
https://support.apple.com/en-us/HT212805Vendor Advisory
https://support.apple.com/en-us/HT212806Vendor Advisory
https://support.apple.com/en-us/HT212807Vendor Advisory
https://support.apple.com/en-us/HT212824Vendor Advisory
https://support.apple.com/en-us/HT212804Vendor Advisory
https://support.apple.com/en-us/HT212805Vendor Advisory
https://support.apple.com/en-us/HT212806Vendor Advisory
https://support.apple.com/en-us/HT212807Vendor Advisory
https://support.apple.com/en-us/HT212824Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31010US Government Resource

Timeline

Published: Aug 24, 2021
Last modified: Jun 17, 2026
Added to CISA KEV: Aug 25, 2022
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-310135.5An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.1, iOS 15.2 and iPadOS 15.2, mac CVE-2021-31094.8The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator CVE-2021-31109.8The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_pro CVE-2021-31114.8The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express CVE-2021-31137.5Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSessio CVE-2021-31146.5In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest CVE-2021-31157.5Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" c CVE-2021-311528.8Multilaser Router AC1200 V02.03.01.45_pt contains a cross-site request forgery (CSRF) vulnerability. An attacker can enable remote access, c CVE-2021-311533.3please before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations CVE-2021-311547.8pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain CVE-2021-311557.8Failure to normalize the umask in please before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at l CVE-2021-311567.5Allied Telesis AT-S115 1.2.0 devices before 1.00.024 with Boot Loader 1.00.006 allow Directory Traversal to achieve partial access to data.