CVE-2021-1768: 
macOS vulnerability analysis and mitigation

CVE-2021-1768 is an out-of-bounds read vulnerability discovered in Apple's Model I/O component that was fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. The vulnerability was discovered by Mickey Jin & Junzhi Lu of Trend Micro working with Trend Micro's Zero Day Initiative and was disclosed in February 2021 (Apple Security).

The vulnerability is classified as an out-of-bounds read issue (CWE-125) that occurs when processing maliciously crafted USD files. The issue was addressed by Apple through improved bounds checking. The vulnerability has a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD Database).

When exploited, this vulnerability could lead to unexpected application termination or arbitrary code execution when processing a maliciously crafted USD file (Apple Security).

Apple addressed this vulnerability in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. Users are advised to update their systems to these versions or later to mitigate the vulnerability (Apple Security).