CVE-2021-30858

HIGH KEV

iOS <14.8-iPadOS <14.8-macOS Big Sur <11.6 - Use After Free

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-30858 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021. EIP tracks 2 public exploits from researchers including kmeps4, Jeromeyoung.

AI-analyzed exploit summary The repository contains only a README.md referencing CVE-2021-30858 without any functional exploit code or technical analysis. It links to an external post but provides no additional details or proof-of-concept.

Description

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Exploits (2)

nomisec STUB 1 stars
by kmeps4 · infoleak
https://github.com/kmeps4/CVEREV3

The repository contains only a README.md referencing CVE-2021-30858 without any functional exploit code or technical analysis. It links to an external post but provides no additional details or proof-of-concept.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by Jeromeyoung · infoleak
https://github.com/Jeromeyoung/ps4_8.00_vuln_poc

The repository contains only a README and a Jekyll config file with no actual exploit code or technical details. It claims to be a PoC for CVE-2021-30858 but lacks any functional implementation.

Classification
Stub 90%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: PlayStation 4 8.xx
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (19)

Core 19
Core References
Third Party Advisory x_refsource_misc
https://support.apple.com/en-us/HT212804
Third Party Advisory x_refsource_misc
https://support.apple.com/en-us/HT212807
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2021/Sep/27
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2021/Sep/25
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2021/Sep/29
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/09/20/1
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2021/Sep/38
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2021/Sep/39
Mailing List, Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2021/dsa-4975
Mailing List, Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2021/dsa-4976
Third Party Advisory x_refsource_confirm
https://support.apple.com/kb/HT212824
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2021/Sep/50
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/10/26/9
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/10/27/1
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/10/27/2
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/10/27/4

Scores

CVSS v3 8.8
EPSS 0.1349
EPSS Percentile 96.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2021-11-03
VulnCheck KEV 2021-09-13
InTheWild.io 2021-09-13
ENISA EUVD EUVD-2021-17775
CWE
CWE-416
Status published
Products (7)
apple/ipados 13.1 - 14.8
apple/iphone_os < 12.5.5
apple/macos < 11.6
debian/debian_linux 10.0
debian/debian_linux 11.0
fedoraproject/fedora 33
fedoraproject/fedora 34
Published Aug 24, 2021
KEV Added Nov 03, 2021
Tracked Since Feb 18, 2026