CVE-2021-30900KEV · OVERDUE

Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

High · published August 24, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 92.5th percentile for exploit probability.

1283
days past CISA
deadline
CVSS v3.1
7.8
EPSS
5%
Percentile
92.5
In the wild
Confirmed
What it is

🚨 An out-of-bounds write flaw lets a malicious app execute arbitrary code with kernel privileges—yikes! 🔥 Think of it like a restaurant where a waiter delivers an order straight to the kitchen without checking the menu first—the chef might whip up something dangerous instead of a delightful dish. 🍽️ In this scenario, an attacker could gain full control over the device, accessing sensitive data, running malicious software, or even taking over your entire system! That's absolutely devastating for anyone's security and privacy! 😱

Put simply

Think of it like a restaurant where a waiter delivers an order straight to the kitchen without checking the menu first—the chef might whip up something dangerous instead of a delightful dish. 🍽️ This vulnerability arises because the system does not properly check memory boundaries, allowing an attacker to write data outside the allocated space. This can lead to executing arbitrary code with the highest privileges possible—kernel-level access.

What to do

In this scenario, an attacker could gain full control over the device, accessing sensitive data, running malicious software, or even taking over your entire system! That's absolutely devastating for anyone's security and privacy! 😱 To protect your device, update to iOS 14.8.1, iPadOS 14.8.1, or iOS 15.1 as soon as possible. Keeping your devices up to date helps fortify them against these sneaky exploits! You've got this! Stay vigilant and keep your systems updated, and you'll be a security hero in no time! 🦸

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.05204 · 92.5th percentile
Published
2021-08-24T18:50Z
KEV added
2023-03-30 · due 2023-04-20
EPSS history
Timeline
  • 30 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 20
    kev
  • 24 AUG 18:50Z
    An out-of-bounds write issue was addressed with improved bounds checking
    cvelistv5