HIGH

CVE-2021-30665

Apple Ipados 2021-09-08 CVSS v3.1

CVSS

8.8

KEV

Description

A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

Summary dbcve.org

A memory corruption vulnerability in WebKit (Apple's browser engine) allows arbitrary code execution when processing maliciously crafted web content. The fix involves improved state management. This was a zero-day vulnerability actively exploited in the wild.

Mitigation

Apply the available Apple security updates (iOS 14.5.1/iPadOS 14.5.1, watchOS 7.4.1, tvOS 14.6, macOS Big Sur 11.3.1, iOS 12.5.3) to all affected devices. Until patched, avoid untrusted web content.

Weakness (CWE)

CWE-787 Out-of-bounds Write

EPSS Score

3.68%

Probability of exploitation in next 30 days

89.2th percentile

References

https://support.apple.com/en-us/HT212335 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT212336 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT212339 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT212341 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT212532 Release Notes, Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30665 Third Party Advisory, US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE