VORANT. Threat Intelligence Sign in Get the full feed

FORCEDENTRY: NSO's zero-click iMessage exploit dissected

high threat media

Objective-See reverse-engineers CVE-2021-30860, the JBIG2 integer overflow in iOS CoreGraphics that NSO Group's Pegasus used as a zero-click iMessage exploit dubbed FORCEDENTRY.

This post is a technical patch-diff analysis of CVE-2021-30860, an integer overflow in Apple's CoreGraphics JBIG2 image decoder that was fixed in iOS/iPadOS 14.8 and macOS Big Sur 11.6. The vulnerability, dubbed FORCEDENTRY by Citizen Lab, was discovered after researchers analyzed crash logs on journalists' phones and found malicious PDF files with embedded JBIG2 streams crashing IMTranscoderAgent, an iMessage component that processes images outside Apple's BlastDoor sandbox. Citizen Lab attributed the exploitation to NSO Group based on the presence of Pegasus spyware on compromised devices.

The author uses BinDiff to compare vulnerable (11.5.2) and patched (11.6) versions of CoreGraphics.dylib, tracing the root cause to JBIG2::readTextRegionSeg, where an unchecked 32-bit addition (numSyms) can wrap around, causing a subsequent gmallocn() allocation to be undersized. A companion copy loop then writes attacker-controlled bitmap data using the original (unwrapped) size, producing a heap buffer overflow. Notably, Apple's fix did not add an overflow check at the point of calculation (unlike a sibling function, readSymbolDictSeg, which already had such a check) but instead bounded the copy loop itself — suggesting a different engineer patched this path and left the root-cause overflow technically unresolved.

The exploit chain required no user interaction: a crafted PDF sent via iMessage would be parsed by IMTranscoderAgent outside the BlastDoor sandbox, enabling remote code execution. The piece underscores that Apple's BlastDoor mitigation, introduced to sandbox iMessage attachment parsing, did not cover all raster/document formats such as PDF and PSD, leaving a gap that FORCEDENTRY exploited. The vulnerability was responsibly disclosed by Citizen Lab on September 7, 2021, and patched by Apple six days later.

Mentioned in this report

Vulnerabilities CVE-2021-30860KEV
Threat actors NSO Group
Malware Pegasus
Campaigns FORCEDENTRY

Detection guidance

IMTranscoderAgent Processing Suspicious PDF Attachments

ATT&CK T1203

Detects IMTranscoderAgent (iMessage component) processing PDF files, which may indicate exploitation of JBIG2 decoder vulnerability via crafted malicious PDFs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: IMTranscoderAgent Processing Suspicious PDF Attachments
description: Detects IMTranscoderAgent processing PDF attachments outside BlastDoor
  sandbox. FORCEDENTRY exploited this path by sending malicious JBIG2-embedded PDFs
  via iMessage that crashed the transcoder, triggering heap overflow in CoreGraphics
  JBIG2 decoder.
tags:
- attack.t1203
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: IMTranscoderAgent
    CommandLine|contains:
    - .pdf
    - transcoder
  filter_legitimate_mail:
    ParentImage|contains:
    - /Applications/Mail.app
    - mailservicesd
  condition: selection and not filter_legitimate_mail
falsepositives:
- Legitimate iMessage attachments with PDF files on vulnerable macOS versions
- Apple Mail processes legitimately transcoding PDFs
level: medium
id: b2cbd459-a592-54e0-b654-4ba352899470
status: experimental
author: Vorant

CoreGraphics JBIG2 Decoder Crash or Memory Anomaly

ATT&CK T1203

Detects CoreGraphics processes with abnormal memory allocation patterns or crashes when processing image data, indicative of integer overflow exploitation in JBIG2 decoder. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: CoreGraphics JBIG2 Decoder Memory Anomaly
description: Detects CoreGraphics processes (particularly those called by IMTranscoderAgent)
  exhibiting unexpected termination or memory allocation anomalies consistent with
  integer overflow in readTextRegionSeg when parsing malicious JBIG2 streams.
tags:
- attack.t1203
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: CoreGraphics
    ParentImage|endswith:
    - IMTranscoderAgent
    - imagent
    ExitCode: '256'
  condition: selection
falsepositives:
- Legitimate PDF processing that triggers unrelated CoreGraphics bugs
- PDF files with genuinely corrupted JBIG2 streams rejected by the parser
level: low
id: 3eebfc0c-6b9b-56f5-ad46-35fa06206fa2
status: experimental
author: Vorant

Malicious PDF or PSD Delivery via iMessage Outside BlastDoor Sandbox

ATT&CK T1027

Detects file attachment handling of PDF or PSD files processed by iMessage components that bypass BlastDoor sandbox, enabling code execution via parser vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Document Format Attachment Processing via iMessage
description: Detects processing of PDF or PSD document attachments by iMessage transcoders
  or agents outside the BlastDoor sandbox. FORCEDENTRY exploited the absence of BlastDoor
  protection for raster and document formats by delivering a malicious JBIG2-embedded
  PDF via iMessage.
tags:
- attack.t1027
- attack.t1203
logsource:
  category: file_event
  product: macos
detection:
  selection:
    Image|endswith:
    - IMTranscoderAgent
    - imagent
    FileName|endswith:
    - .pdf
    - .psd
  filter_user_temp:
    FileName|contains:
    - /var/tmp
    - /tmp
  condition: selection and not filter_user_temp
falsepositives:
- Routine iMessage attachment processing on vulnerable unpatched systems
- User sharing PDF/PSD files via iMessage legitimately
level: medium
id: aa373144-02d3-52ca-be7b-177b4a7e1187
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x67.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free