On September 13, 2021, Apple released iOS 14.8 and iPadOS 14.8, credited Citizen Lab, and acknowledged reports that CVE-2021-30860 might have been actively exploited. That coordinated disclosure and patch is the timeline anchor for FORCEDENTRY, one of the most technically sophisticated exploits publicly documented. Citizen Lab had found it during forensic examination of an already-compromised iPhone; the supplied evidence does not give an exact first-use date, which is why the disclosure date anchors the entry.
FORCEDENTRY is remarkable not only for what it did but for how it did it. It turned an image decoder into a small, programmable computer—inside a phone that never rang, buzzed, or asked the target to tap anything.
CVE-2021-30860 is an integer overflow in Apple's CoreGraphics component, specifically its JBIG2 image processing, leading to memory corruption and arbitrary code execution during the processing of a malicious PDF. In the observed iMessage chain, the interaction required was zero-click: the target did not have to open an attachment or tap a link.
Apple patched broadly across its platforms: iOS and iPadOS in 14.8, macOS Big Sur in 11.6, macOS Catalina through Security Update 2021-005, and watchOS in 7.6.2. That range matters—this was not an iPhone-only fix. On CVSS, the supplied evidence contains no authoritative Apple or NVD score, and it would be wrong to infer one from the zero-click label. Severity here is best conveyed through the mechanism and the outcome, not a fabricated number.
FORCEDENTRY arrived as an iMessage attachment that looked like a GIF by name but internally contained data parsed as a PDF or other supported image format. Apple's image-processing stack examined the content rather than trusting the file extension, so the malicious data reached CoreGraphics and its JBIG2 decoder. This is a content-type parsing issue, not a simple filename trick—an important distinction.
An integer overflow occurred while the decoder collected and counted referenced symbols. The wrapped value produced an allocation smaller than the data later written into it, causing out-of-bounds writes into adjacent heap objects. The exploit then manipulated bitmap structures to obtain broader memory access.
The unusual sophistication lay in how it performed computation. The malicious document supplied more than 70,000 JBIG2 segment commands and used the format's refinement operations as logic primitives, constructing a Turing-complete "weird machine" inside the image decoder. That machinery could search and manipulate process memory while working within the constraints of modern platform defenses. Critically, the chain targeted IMTranscoderAgent, which processed media before it reached the BlastDoor isolation boundary—so the exploit bypassed the very mitigation Apple had introduced against earlier iMessage attacks. CVE-2021-30860 was central, but the full device-compromise result depended on additional exploit logic beyond this one bug.
Citizen Lab found FORCEDENTRY while examining an iPhone belonging to a Saudi activist. It attributed the chain to NSO Group with high confidence, based on forensic artifacts including the "CASCADEFAIL" deletion failure in DataUsage.sqlite and the process name setframed, which had appeared in earlier Pegasus investigations. That attribution should always carry its stated basis—high confidence from forensic artifacts—rather than be presented as an unqualified universal fact.
The objective was deployment of Pegasus spyware without requiring the target to click a link or open an attachment. Reporting places journalists, human-rights defenders and political dissidents among the populations targeted by commercial spyware operations.
FORCEDENTRY was highly targeted, not a mass-deployed internet exploit. The supplied evidence documents individual forensic cases and classes of targeted civil-society users, but it does not establish a global victim total—and inventing one would misrepresent the incident.
The technical impact was arbitrary code execution as part of a larger chain capable of installing spyware. It is worth distinguishing the vulnerability's processing-stage code execution from the complete device-compromise chain that followed. The bug opened the door; the operation did much more once inside.
Mobile forensic work—imaging devices, storing sysdiagnose logs and spyware artifacts—needs fast, reliable external storage. The Samsung T7 Portable SSD is a portable drive well suited to offline evidence handling.
Amazon Affiliate Link
Apple corrected the integer overflow through improved input validation and shipped patches across iOS, iPadOS, macOS and watchOS. For users, immediate updating was the practical defense.
The case illustrated the asymmetry of zero-click exploitation. Google later observed that users had virtually no behavioral defense against such attacks because no click or document-opening decision was required. The durable response had to come from safer parsers, stronger isolation boundaries, exploit mitigations and forensic notification—not awareness training alone. Google Project Zero published a deeper technical analysis in December 2021, describing FORCEDENTRY as one of the most sophisticated exploits it had seen.
FORCEDENTRY showed that complex document formats can serve as programmable attack environments. It also demonstrated that a new sandbox changes attacker routing rather than ending exploitation: the chain deliberately targeted processing that occurred before the intended isolation boundary, sidestepping BlastDoor.
The incident brought commercial surveillance vendors into the core zero-day discussion. Google reported tracking more than 30 such vendors and argued that they proliferate capabilities once limited to top-tier state programs. The enduring image is precisely that: a malicious file that built a computer inside an image decoder, delivered to a device that gave its owner no chance to say no.