FORCEDENTRY: NSO's zero-click iMessage exploit dissected

Objective-See reverse-engineers CVE-2021-30860, the JBIG2 integer overflow in iOS CoreGraphics that NSO Group's Pegasus used as a zero-click iMessage exploit dubbed FORCEDENTRY.

This post is a technical patch-diff analysis of CVE-2021-30860, an integer overflow in Apple's CoreGraphics JBIG2 image decoder that was fixed in iOS/iPadOS 14.8 and macOS Big Sur 11.6. The vulnerability, dubbed FORCEDENTRY by Citizen Lab, was discovered after researchers analyzed crash logs on journalists' phones and found malicious PDF files with embedded JBIG2 streams crashing IMTranscoderAgent, an iMessage component that processes images outside Apple's BlastDoor sandbox. Citizen Lab attributed the exploitation to NSO Group based on the presence of Pegasus spyware on compromised devices.

The author uses BinDiff to compare vulnerable (11.5.2) and patched (11.6) versions of CoreGraphics.dylib, tracing the root cause to JBIG2::readTextRegionSeg, where an unchecked 32-bit addition (numSyms) can wrap around, causing a subsequent gmallocn() allocation to be undersized. A companion copy loop then writes attacker-controlled bitmap data using the original (unwrapped) size, producing a heap buffer overflow. Notably, Apple's fix did not add an overflow check at the point of calculation (unlike a sibling function, readSymbolDictSeg, which already had such a check) but instead bounded the copy loop itself — suggesting a different engineer patched this path and left the root-cause overflow technically unresolved.

The exploit chain required no user interaction: a crafted PDF sent via iMessage would be parsed by IMTranscoderAgent outside the BlastDoor sandbox, enabling remote code execution. The piece underscores that Apple's BlastDoor mitigation, introduced to sandbox iMessage attachment parsing, did not cover all raster/document formats such as PDF and PSD, leaving a gap that FORCEDENTRY exploited. The vulnerability was responsibly disclosed by Citizen Lab on September 7, 2021, and patched by Apple six days later.

Source reporting: https://objective-see.org/blog/blog_0x67.html