Cyber Resilience

CVE-2021-1782

Apple Mac Os X 10.14 – 10.14.6

CISA KEVActive ExploitationEUVD Exploited
Published
02 April 2021
Modified
23 October 2025
KEV Added
03 November 2021
Patch / advisory
CVSS Score v3.1 7.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.022 81th percentile
Risk Priority 78 floored blend · peak EPSS

Summary

CVE-2021-1782 is a high-severity Improper Locking (CWE-667) vulnerability in Apple Mac Os X. Its CVSS base score is 7.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked in the top 19% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

A race condition vulnerability stemming from improper locking, tracked as CVE-2021-1782 and assigned CWE-667, affects multiple Apple operating systems including macOS Big Sur, Catalina, and Mojave along with iOS 14, iPadOS 14, tvOS 14, and watchOS 7. The flaw permits a malicious application to elevate privileges on the affected platform, as confirmed by its CVSS 3.1 vector indicating local attack with high complexity but full impact on confidentiality, integrity, and availability.

An attacker with the ability to run code as a low-privileged local user can exploit the race condition to gain elevated rights. Because the issue requires only local access and no user interaction, it can be triggered from within a sandboxed or third-party application that an end user has already installed.

Apple has released fixes in macOS Big Sur 11.2, Security Update 2021-001 for Catalina and Mojave, iOS 14.4 and iPadOS 14.4, tvOS 14.4, and watchOS 7.3; the corresponding security advisories direct administrators to apply these updates to address the locking deficiency.

Apple has stated that it is aware of reports indicating the vulnerability may have been actively exploited in the wild prior to patching.

EU & UK References

Vulnerability Data

A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able…

more

to elevate privileges. Apple is aware of a report that this issue may have been actively exploited..

CWE(s)
KEV Date Added
03 November 2021

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-43510Same product: Apple Ipadosboth on KEV
CVE-2020-9859Same product: Apple Ipadosboth on KEV
CVE-2022-48618Same product: Apple Ipadosboth on KEV
CVE-2022-22675Same product: Apple Ipadosboth on KEV
CVE-2020-27930Same product: Apple Ipadosboth on KEV
CVE-2021-30665Same product: Apple Ipadosboth on KEV
CVE-2021-30883Same product: Apple Ipadosboth on KEV
CVE-2020-3837Same product: Apple Ipadosboth on KEV
CVE-2023-41990Same product: Apple Ipadosboth on KEV
CVE-2021-31010Same product: Apple Ipadosboth on KEV

Affected Assets

apple
ipados
≤ 14.4
apple
iphone os
≤ 14.4
apple
mac os x
10.14.6, 10.15.7 · 10.14 — 10.14.6 · 10.15 — 10.15.7
apple
macos
11.0 — 11.2
apple
tvos
≤ 14.4
apple
watchos
≤ 7.3

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include code reviews, static analysis, and concurrency standards that prevent improper locking.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect race conditions and locking errors before release.

prevents

Secure development lifecycle includes concurrency and locking requirements that reduce improper locking defects.

prevents

Application security requirements can mandate proper lock acquisition/release patterns.

prevents

Secure architecture principles address thread-safety and resource synchronization.

prevents

Secure coding standards directly prohibit missing or incorrect lock usage.

prevents

Change management may catch locking issues introduced by modifications but does not prevent the weakness itself.

References