CVE-2021-30762KEV · OVERDUE

Apple iOS WebKit Use-After-Free Vulnerability

High · published September 8, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 95.9th percentile for exploit probability.

1802
days past CISA
deadline
CVSS v3.1
8.8
EPSS
11%
Percentile
95.9
In the wild
Confirmed
What it is

🚨 A sneaky use after free vulnerability in iOS could let attackers run arbitrary code with just a malicious webpage! Imagine a chef who accidentally leaves a crucial ingredient out of a recipe, leading to a dish that can be tampered with. This means that any web content served up could have hidden surprises, much like that dish gone wrong! This flaw allows an attacker to execute arbitrary code, essentially gaining control over the device. If exploited, this could lead to data theft, accessing sensitive information, or even taking complete control of the device – a truly nightmarish scenario! 🔥

Put simply

Imagine a chef who accidentally leaves a crucial ingredient out of a recipe, leading to a dish that can be tampered with. This means that any web content served up could have hidden surprises, much like that dish gone wrong! CVE-2021-30762 is a use after free vulnerability that occurs when memory management is improperly handled. When processing maliciously crafted web content, this flaw can expose systems to arbitrary code execution.

What to do

This flaw allows an attacker to execute arbitrary code, essentially gaining control over the device. If exploited, this could lead to data theft, accessing sensitive information, or even taking complete control of the device – a truly nightmarish scenario! 🔥 To protect your device, update to iOS version 12.5.4 immediately. Encourage all users to ensure they are running the latest version, as this patch addresses the critical vulnerability. Regularly check for updates to stay secure! 🛡️ You've got this! Just follow these steps, and your device will be safe and sound in no time. 😊

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.10986 · 95.9th percentile
Published
2021-09-08T13:46Z
KEV added
2021-11-03 · due 2021-11-17
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by Nov 17
    kev
  • 08 SEP 13:46Z
    A use after free issue was addressed with improved memory management
    cvelistv5