A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
Summary: Google Project Zero analyzed FORCEDENTRY, an NSO iMessage zero-click exploit used to target a Saudi activist, which Citizen Lab captured from an iPhone and which Apple fixed on September 13, 2021 as CVE-2021-30860 in iOS 14.8. The exploit abused iMessage's handling of .gif files to reach the CoreGraphics PDF parser, where a JBIG2 integer overflow in segment collation gave remote code execution with no user interaction.
What's compelling: Project Zero calls this one of the most technically sophisticated exploits it has seen and says NSO's capabilities rival those previously thought accessible to only a handful of nation states - and with a zero-click chain, a target's phone number or AppleID is the only entry point required.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-30860
- Related
- CVE-2021-30860: Apple Multiple Products Integer Overflow Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Microsoft Patch Tuesday, September 2021 Edition Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026