CVE-2021-1782: Apple Multiple Products Race Condition Privilege Escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a locally exploitable privilege escalation with confirmed active exploitation and KEV listing, though it requires the attacker to already run code on the device.

What it is

A race condition in Apple's macOS, iOS, iPadOS, watchOS and tvOS was addressed with improved locking. A malicious application can exploit the race to elevate privileges, and Apple stated it was aware of a report that the issue may have been actively exploited.

Impact

An attacker who can run a malicious application on a vulnerable device gains elevated privileges, potentially reaching kernel-level or higher-integrity code execution.

Attack surface

The flaw is local (CVSS vector AV:L) and requires the attacker to run a malicious application on the target device; no user interaction beyond launching that app is needed, and low privileges are sufficient (PR:L).

Exploitation

The vulnerability is listed in CISA KEV with a 2021-11-17 remediation due date, and Apple acknowledged reports of active exploitation; EPSS 30-day probability is about 2.2 percent.

What to do

• Apply the vendor updates: macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4.
• Enforce a minimum OS baseline across managed Apple devices and block or flag devices below the fixed versions.
• Restrict installation of untrusted or sideloaded applications on managed endpoints to reduce the local attack path.
• Monitor CISA KEV guidance and confirm remediation by the 2021-11-17 due date for federal and regulated environments.

Detection

• Alert on unexpected privilege transitions or processes spawning with elevated integrity from user-writable locations.
• Hunt for anomalous application behavior consistent with local privilege escalation, such as unusual kernel or system service interactions.
• Track OS build versions in endpoint inventory and report devices still below the fixed releases.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.