CVE-2021-30858KEV · OVERDUE

Apple iOS, iPadOS, macOS Use-After-Free Vulnerability

High · published August 24, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 96.4th percentile for exploit probability.

1803
days past CISA
deadline
CVSS v3.1
8.8
EPSS
13%
Percentile
96.4
In the wild
Confirmed
What it is

🚨 A crafty web request could lead to total chaos! A use-after-free vulnerability in Apple's software means that processing maliciously crafted web content might allow arbitrary code execution. 🔥 Think of it like a restaurant where the chef keeps serving the same dish without checking if the ingredients have gone bad. A rogue ingredient can turn a perfect meal into a disaster—just like this vulnerability can turn a harmless web page into a hacker's playground. An attacker could exploit this issue to run any code they choose, potentially taking over your device. This could lead to stolen personal data or even remote control of your system—absolutely devastating!

Put simply

Think of it like a restaurant where the chef keeps serving the same dish without checking if the ingredients have gone bad. A rogue ingredient can turn a perfect meal into a disaster—just like this vulnerability can turn a harmless web page into a hacker's playground. This use-after-free vulnerability arises when memory that has already been freed is accessed again, allowing attackers to manipulate the application’s execution flow, leading to arbitrary code execution on affected devices.

What to do

An attacker could exploit this issue to run any code they choose, potentially taking over your device. This could lead to stolen personal data or even remote control of your system—absolutely devastating! To protect yourself, update your devices to iOS 14.8, iPadOS 14.8, or macOS Big Sur 11.6 immediately. Regularly patch your systems to stay ahead of these vulnerabilities and review your security protocols for handling web content. You've got this! Stay vigilant and keep your devices updated to lock down your security! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.13379 · 96.4th percentile
Published
2021-08-24T18:49Z
KEV added
2021-11-03 · due 2021-11-17
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by Nov 17
    kev
  • 24 AUG 18:49Z
    A use after free issue was addressed with improved memory management
    cvelistv5