Vulnerability Spotlight: Vulnerability in Apple iOS, iPad OS and MacOS could lead to disclosure of sensitive memory data

Summary: Jaewon Min of Cisco Talos discovered an out-of-bounds read vulnerability in Apple's ImageIO library, tracked as TALOS-2021-1414 (CVE-2021-30939), in the DDS image parsing functionality of macOS and iOS. Triggered when a user opens a specially crafted malicious file, it can leak heap addresses and other memory data that could aid exploitation of other vulnerabilities; Apple has released an update, and affected versions tested include iOS 15.1 and macOS Big Sur 11.6.1.
What you should know: The bug hands an attacker heap addresses and other memory contents, the raw material for chaining a follow-on exploit, and it fires when a user simply opens a crafted image file on iOS 15.1 or macOS Big Sur 11.6.1.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-30939
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026