FORCEDENTRY: NSO's zero-click iMessage exploit dissected

Published16 September 2021 Vorant ratinghigh threat Media

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Objective-See reverse-engineers CVE-2021-30860, the JBIG2 integer overflow in iOS CoreGraphics that NSO Group's Pegasus used as a zero-click iMessage exploit dubbed FORCEDENTRY.

Sourceobjective-see.org — open the original

What to check

Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
Exploitation: CISA lists CVE-2021-30860 as exploited in the wild.

This post is a technical patch-diff analysis of CVE-2021-30860, an integer overflow in Apple's CoreGraphics JBIG2 image decoder that was fixed in iOS/iPadOS 14.8 and macOS Big Sur 11.6. The vulnerability, dubbed FORCEDENTRY by Citizen Lab, was discovered after researchers analyzed crash logs on journalists' phones and found malicious PDF files with embedded JBIG2 streams crashing IMTranscoderAgent, an iMessage component that processes images outside Apple's BlastDoor sandbox. Citizen Lab attributed the exploitation to NSO Group based on the presence of Pegasus spyware on compromised devices.

The author uses BinDiff to compare vulnerable (11.5.2) and patched (11.6) versions of CoreGraphics.dylib, tracing the root cause to JBIG2::readTextRegionSeg, where an unchecked 32-bit addition (numSyms) can wrap around, causing a subsequent gmallocn() allocation to be undersized. A companion copy loop then writes attacker-controlled bitmap data using the original (unwrapped) size, producing a heap buffer overflow. Notably, Apple's fix did not add an overflow check at the point of calculation (unlike a sibling function, readSymbolDictSeg, which already had such a check) but instead bounded the copy loop itself — suggesting a different engineer patched this path and left the root-cause overflow technically unresolved.

The exploit chain required no user interaction: a crafted PDF sent via iMessage would be parsed by IMTranscoderAgent outside the BlastDoor sandbox, enabling remote code execution. The piece underscores that Apple's BlastDoor mitigation, introduced to sandbox iMessage attachment parsing, did not cover all raster/document formats such as PDF and PSD, leaving a gap that FORCEDENTRY exploited. The vulnerability was responsibly disclosed by Citizen Lab on September 7, 2021, and patched by Apple six days later.

Mentioned in this report

Vulnerabilities CVE-2021-30860KEV

Threat actors NSO Group

Malware Pegasus

Campaigns FORCEDENTRY

Detection guidance

IMTranscoderAgent Processing Suspicious PDF Attachments

ATT&CK T1203 · status experimental · needs macos process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects IMTranscoderAgent (iMessage component) processing PDF files, which may indicate exploitation of JBIG2 decoder vulnerability via crafted malicious PDFs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: IMTranscoderAgent Processing Suspicious PDF Attachments
description: Detects IMTranscoderAgent processing PDF attachments outside BlastDoor
  sandbox. FORCEDENTRY exploited this path by sending malicious JBIG2-embedded PDFs
  via iMessage that crashed the transcoder, triggering heap overflow in CoreGraphics
  JBIG2 decoder.
tags:
- attack.t1203
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: IMTranscoderAgent
    CommandLine|contains:
    - .pdf
    - transcoder
  filter_legitimate_mail:
    ParentImage|contains:
    - /Applications/Mail.app
    - mailservicesd
  condition: selection and not filter_legitimate_mail
falsepositives:
- Legitimate iMessage attachments with PDF files on vulnerable macOS versions
- Apple Mail processes legitimately transcoding PDFs
level: medium
id: b2cbd459-a592-54e0-b654-4ba352899470
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x67.html

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs, actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs