CVE-2021-30665

HIGH KEV

iPadOS < 14.5.1 - Out-of-bounds Write via Malicious Web Content

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-30665 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021.

Description

A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

References (6)

Core 6
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT212532
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT212341
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT212335
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT212336
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT212339

Scores

CVSS v3 8.8
EPSS 0.0019
EPSS Percentile 40.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2021-11-03
VulnCheck KEV 2021-05-03
InTheWild.io 2021-05-03
ENISA EUVD EUVD-2021-17582
CWE
CWE-787
Status published
Products (5)
apple/ipados < 14.5.1
apple/iphone_os < 12.5.3
apple/macos < 11.3.1
apple/tvos < 14.6
apple/watchos < 7.4.1
Published Sep 08, 2021
KEV Added Nov 03, 2021
Tracked Since Feb 18, 2026