CVE-2021-30661: high-severity vulnerability in Apple Safari
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
A memory management flaw in Safari and Apple systems allows attackers to execute arbitrary code by crafting malicious web content. This vulnerability was actively exploited in the wild.
Use-after-free vulnerability (CWE-416) in WebKit memory management. Attack vector is network-based through maliciously crafted web content; no user interaction beyond visiting a malicious site is required. Successful exploitation leads to arbitrary code execution in the context of the vulnerable application.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.