Apple · iOS, macOS, watchOS
CVE-2021-31010
Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability
Qué es
A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..
CISA: In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions.
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 15 de septiembre de 2022
Más fallos explotados de Apple
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 29 sept 2026 | Out-of-Bounds Write | Multiple Products | Alto 8,8 | 26% |
| 18 ago 2026 | Improper Authentication | macOS | Crítica 9,8 | 1,7% |
| 20 mar 2026 | Buffer Overflow | Multiple Products | Alto 8,8 | 1,7% |
| 20 mar 2026 | Improper Locking | Multiple Products | Alto 7,8 | 0,4% |
| 20 mar 2026 | Classic Buffer Overflow | Multiple Products | Media 5,5 | 0,4% |
| 5 mar 2026 | Integer Overflow or Wraparound | Multiple Products | Alto 8,8 | 7,0% |
| 5 mar 2026 | Use-After-Free | iOS and iPadOS | Alto 7,8 | 2,0% |
| 5 mar 2026 | Use-After-Free | Multiple Products | Alto 8,8 | 4,0% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.