CVE-2021-30665KEV · OVERDUE

Apple Multiple Products WebKit Memory Corruption Vulnerability

High · published September 8, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 89.7th percentile for exploit probability.

1802
days past CISA
deadline
CVSS v3.1
8.8
EPSS
4%
Percentile
89.7
In the wild
Confirmed
What it is

🚨 A memory corruption issue in Apple's ecosystem could let attackers run arbitrary code just by processing maliciously crafted web content! 🔥 Think of it like a restaurant that serves a dish with a hidden ingredient – a chef who doesn’t check the list might accidentally serve something toxic. In this case, the malicious web content is that hidden ingredient, sneaking in to wreak havoc on your device. If exploited, an attacker could gain control over your device, potentially accessing sensitive data, installing malware, or disrupting functionality. This means your digital life could be at risk, and that's absolutely devastating! 🔥

Put simply

Think of it like a restaurant that serves a dish with a hidden ingredient – a chef who doesn’t check the list might accidentally serve something toxic. In this case, the malicious web content is that hidden ingredient, sneaking in to wreak havoc on your device. This vulnerability stems from improper state management caused by memory corruption in the way Apple devices process certain web content, allowing attackers to execute arbitrary code remotely without user intervention.

What to do

If exploited, an attacker could gain control over your device, potentially accessing sensitive data, installing malware, or disrupting functionality. This means your digital life could be at risk, and that's absolutely devastating! 🔥 To protect yourself, immediately update your devices to the latest versions: watchOS 7.4.1, iOS 14.5.1, iPadOS 14.5.1, tvOS 14.6, or macOS Big Sur 11.3.1. Also, make sure to enable automatic updates so you won't miss future patches! You've got this! Stay updated and keep your devices secure! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03706 · 89.7th percentile
Published
2021-09-08T14:25Z
KEV added
2021-11-03 · due 2021-11-17
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by Nov 17
    kev
  • 08 SEP 14:25Z
    A memory corruption issue was addressed with improved state management
    cvelistv5