CVE-2021-30959

Vulnerability

A buffer overflow issue exists in the audio file parsing code of macOS, affecting systems prior to macOS Big Sur 11.6.2 and Security Update 2021-008 Catalina. The vulnerability is triggered when processing a maliciously crafted audio file, leading to memory corruption. Affected versions include macOS Big Sur before 11.6.2 and macOS Catalina before the Security Update 2021-008.

Exploitation

An attacker must craft a malicious audio file and deliver it to the target user. The user then needs to open or parse the audio file with an application that invokes the vulnerable audio parsing code (for example, QuickTime Player or any app using the system audio decoder). No additional authentication or elevated privileges are required for the attack vector; it is a standard user-interaction scenario.

Impact

Successful exploitation of the buffer overflow can lead to disclosure of user information. The impact is limited to information disclosure; the description does not indicate arbitrary code execution or privilege escalation. The attacker may gain access to data that was otherwise protected within the system's memory.

Mitigation

Apple released fixes on December 13, 2021: macOS Big Sur 11.6.2 and Security Update 2021-008 Catalina. Users should update to these or later versions to remediate the vulnerability. No workarounds are provided in the available references [1], [2].