FORCEDENTRY: The Zero-Click iMessage Exploit That Beat BlastDoor

September 2021 closed the Pegasus chapter with a technical mic-drop. Citizen Lab’s FORCEDENTRY analysis (published 13 December 2021 technically, following Apple’s urgent 13 September emergency patches for CVE-2021-30860 — but the September patch event IS the story’s pivot) revealed that NSO Group had achieved the impossible-for-the-era: a zero-click iMessage exploit defeating Apple’s BlastDoor sandbox, via a logic bug hidden in CoreGraphics’ PDF font parser (a bogus GFN table entry in a crafted font’s dataflow-driven bytecode — a one-integer-property font hack). The exploit chain began with a malicious PDF-bearing message processed automatically by iMessage (no user interaction), abused infinite-loop-ish font-data interpretation to memcpy-controlled heap shaping, and culminated in kernel-level code execution via a separately-patched IOMobileFrameBuffer bug (CVE-2021-30883 after an earlier 30858). The sophistication payload: NSO paid for and maintained exploit engineering at nation-state grade — the reference implementation of “mercenary spyware with APT capabilities,” which is why CISA-ish guidance and Apple’s subsequent Lockdown Mode (iOS 16, 2022) cite FORCEDENTRY-era lessons directly.

What happened

Sequence: Pegasus Project (July 2021) exposed the targeting; Citizen Lab was already forensically tracking specific victims. The September 13 patches: Apple shipped iOS 14.8/macOS emergency updates crediting Citizen Lab unusually fast — press immediately connected the “activist phone” case. December 13, 2021: Citizen Lab’s full technical report detailed the exploit — name-dropped “FORCEDENTRY” (vs the implant’s internal codename set), establishing: zero-click via iMessage; BlastDoor bypass via CoreGraphics font-parser logic bug; JBIG2-stream logical compute engine (the “computer inside a PDF” trick using bitwise ops to synthesize conditions); kernel pivot. February 2022 follow-ups: second FORCEDENTRY variant chains CVE-2021-30883 (IOMobileFrameBuffer recursion) documented by Citizen Lab/Trend Micro coordinated disclosure. Apple’s NSO lawsuit (filed November 2021, citing FORCEDENTRY as exhibit-grade evidence) and Lockdown Mode (July 2022 announcement, iOS 16 ship) complete the arc.

Why the engineering impressed even adversaries’ peers: the exploit weaponised JBIG2 (an image-compression format’s logical operators) to build a Turing-complete-ish computation substrate inside font parsing — then used it for memory disclosure/write primitives — a two-layers-deep “parser within a parser” construction that few teams on earth could author, debug, and reliability-ship. That’s the “NSO = nation-state grade” proof point cited in every subsequent policy discussion (US Entity Listing Sept 2021; subsequent sanctions expansions).

How it worked

The chain in one diagram:

delivery (zero-click):
  victim iPhone receives iMessage containing
  malicious PDF disguised as GIF attachment;
  iMessage auto-processes for preview rendering

BlastDoor context:
  iOS 14's BlastDoor sandbox isolates message-
  parsing (specifically to blunt zero-clicks);
  FORCEDENTRY never needed to "escape" it - the
  bug class lived INSIDE an allowed parser

core exploit (CVE-2021-30860, CoreGraphics):
  crafted font in PDF -> JBIG2-stream font-data
  interpretation -> GFN/property-table integer
  confusion -> JBIG2 logical operators compose
  AND/OR/XOR gates -> mini "computer" built from
  image-compression ops -> controlled heap
  read/write primitives

privilege escalation:
  staged userspace -> kernel bugs
  (CVE-2021-30858 then 30883, IOMobileFrameBuffer)
  -> kernel code execution

implant (Pegasus):
  full device takeover: messages, mic, camera,
  location, keychain, app data exfil; stealth
  persistence per NSO tradecraft

patch reference: iOS 14.8 (13 Sept 2021) +
iOS 15/16 hardening + Lockdown Mode (extreme
personal defence mode)

The “parser within a parser” pattern (font data inside images inside PDFs inside messages) generalises as the eternal zero-click surface — every added format interpreter multiplies trust boundaries, which is why message-platform architecture has trended BlastDoor-ward (deny-by-default sandboxed preview) since, a design lesson we track alongside identity attack-surface guidance.

Impact and numbers

Timeline

Why it still matters in 2026

FORCEDENTRY is the reference node linking three threads that define 2026’s threat landscape: (1) mercenary-spyware capability parity with state actors — the baseline assumption behind modern targeted-individual protection (Lockdown Mode, threat notifications, MVT forensics, per-victim IR retainer models); (2) parser-surface inevitability — every messaging/format platform still fights zero-click-class bugs (2023–2025 iOS/Android zero-clicks keep proving it), so BlastDoor-style deny-by-default isolation and extreme-optional hardening modes remain the durable architecture; (3) commercial-implant governance — FORCEDENTRY as legal evidence (Apple v. NSO) and policy anchor (Entity Listing, subsequent Intellexa sanctions 2024, EU-level spyware inquiries) established that exploit markets face consequences imperfect prosecutors can actually reach. For practitioners, it’s the standing case that “patch promptly” is necessary-not-sufficient for high-value targets: layered personal defence (extreme modes, notification triage, forensic readiness) is a distinct discipline — the individual-protection tier we cover in identity-security guidance.

Detection and hardening takeaways

• Assume zero-click, design deny-by-default. Message-preview processing should run sandboxed with minimal service reach (BlastDoor philosophy); keep risky format parsing (fonts-in-PDFs-in-messages, animated formats, legacy codecs) isolated or off for high-risk users — Lockdown Mode operationalises exactly this.
• Treat extreme-mode adoption as a persona-based control. Journalists, activists, executives, and dissidents merit Lockdown-Mode-class defaults, not optional afterthoughts; fleet MDM should make one-tap enablement and telemetry policy standard for flagged personas.
• Monitor Apple/Google threat notifications as tripwires. Mercenary-spyware notifications (expanded post-2021, refined 2023–2025) are high-fidelity signals — route them to IR with P0 SLAs and MVT-class forensic follow-up, never to user-dismissal.
• Maintain forensic-readiness for personal devices. MVT (Amnesty) and lockdownd/artifact triage capability — internal or partner-retained — turns “we think that phone was hit” into evidence-grade determination within hours; FORCEDENTRY was caught exactly this way.
• Track parser-boundary changes in your mobile fleet. Major iOS/Android releases reshuffle preview-sandbox scope; diff release notes for sandbox/parser changes and update high-risk-user guidance the same week — the zero-click surface moves every OS cycle.

FAQ

How is FORCEDENTRY different from the Pegasus Project revelations?

Pegasus Project (July 2021) exposed the who — 50,000-number targeting database, victims, NSO’s client list patterns. FORCEDENTRY (Sept–Dec 2021) exposed the how at engineering depth — the actual zero-click exploit chain captured in the wild, proving BlastDoor-defeating, Turing-complete-parser-abusing sophistication. Together they closed the loop: political scandal plus technical ground truth equals regulatory/lawsuit-grade evidence.

What was the “computer inside the PDF” exactly?

The JBIG2 image-compression format supports logical operators (AND/OR/XOR/refinement) on image regions. The crafted font’s data drove chains of these operations to synthesize arithmetic — effectively building a tiny CPU out of image-compression primitives — which then computed the controlled memory read/write sequences the exploit needed. Building a virtual machine out of a compression format’s logic gates inside a font inside a PDF inside a message is the quiet part of the genius: four trust-boundary layers deep, all “working as designed.”

Does Lockdown Mode actually stop this class?

It materially raises cost and shrinks surface: previews of risky formats degrade, aggressive parsing paths close, wireless-attack surfaces (cable/wireless pairing abuse) restrict, and JIT-based web attack paths narrow. Nothing is absolute against a funded adversary with unknown bugs, but post-Lockdown Mode public reporting shows NSO-class vendors struggling against locked devices — Apple’s own statements and Citizen Lab follow-ups describe exploits failing or requiring new costly chains (which then get burned and patched). It’s the right model: extreme-personal defence as a deliberate tier, not a promise of invulnerability.