CVE-2021-1782
Apple Mac Os X 10.14 – 10.14.6
Raw vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2021-1782 is a high-severity Improper Locking (CWE-667) vulnerability in Apple Mac Os X. Its CVSS base score is 7.0 (High).
Operationally, ranked in the top 18% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A race condition vulnerability stemming from improper locking, tracked as CVE-2021-1782 and assigned CWE-667, affects multiple Apple operating systems including macOS Big Sur, Catalina, and Mojave along with iOS 14, iPadOS 14, tvOS 14, and watchOS 7. The flaw permits a malicious application to elevate privileges on the affected platform, as confirmed by its CVSS 3.1 vector indicating local attack with high complexity but full impact on confidentiality, integrity, and availability.
An attacker with the ability to run code as a low-privileged local user can exploit the race condition to gain elevated rights. Because the issue requires only local access and no user interaction, it can be triggered from within a sandboxed or third-party application that an end user has already installed.
Apple has released fixes in macOS Big Sur 11.2, Security Update 2021-001 for Catalina and Mojave, iOS 14.4 and iPadOS 14.4, tvOS 14.4, and watchOS 7.3; the corresponding security advisories direct administrators to apply these updates to address the locking deficiency.
Apple has stated that it is aware of reports indicating the vulnerability may have been actively exploited in the wild prior to patching.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-7246
Vulnerability Data
A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able…
more
to elevate privileges. Apple is aware of a report that this issue may have been actively exploited..
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle includes concurrency and locking requirements that reduce improper locking defects.
A.8.26 only requires that security requirements (including resilience against attacks such as buffer overflows or SQL injection) be identified and specified during development or acquisition; it does not itself enforce, implement, or prevent improper locking from being present or exploitable in the resulting application.
Secure architecture principles address thread-safety and resource synchronization.
Secure coding standards directly prohibit missing or incorrect lock usage.
Security testing can detect race conditions and locking errors before release.
Change management may catch locking issues introduced by modifications but does not prevent the weakness itself.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-667, a class-level weakness, and none of its children carries one either.