CVE-2021-30834

Vulnerability

A logic issue in the audio processing component of Apple operating systems was addressed with improved state management. Processing a malicious audio file may result in unexpected application termination or arbitrary code execution. Affected versions include iOS and iPadOS prior to 14.8 and 15, tvOS prior to 15, watchOS prior to 8, and macOS Catalina prior to Security Update 2021-007 [1][3][4].

Exploitation

An attacker must convince a user to process a specially crafted audio file. No authentication or special privileges are required beyond normal user interaction. The attacker delivers the malicious file via email, web download, or other means, and upon processing, the logic issue triggers the exploit.

Impact

Successful exploitation can lead to unexpected application termination or arbitrary code execution at the privilege level of the affected application. Depending on the app's permissions, this may allow full device compromise, including code execution with kernel privileges in some contexts.

Mitigation

Apple has released patches in iOS 14.8 and iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, watchOS 8, and Security Update 2021-007 Catalina. Users should update to the latest available versions. No workaround is documented [1][3][4].