CVE-2021-30663highunder attackCWE-190

CVE-2021-30663: high-severity vulnerability in Apple macOS

Published · Updated

Follow this CVE+ Monitor macOS+ Monitor webkit2gtk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.8epss 3.5%
from disclosure to weapon
Published on NVDSep 8
CISA KEV+56d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products (9 components)
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6
none_available: Affected
Fixed
3 products (70 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux Server (v. 7 ELS) · Red Hat Enterprise Linux Server Optional (v. 7 ELS)
fix ↗
Not affected
4 products (436 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat CodeReady Linux Builder (v. 8) · Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux 9
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

A vulnerability in how Apple devices handle large numbers in web content can cause the system to crash or run malicious code. This happens when specially crafted websites exploit how the device calculates with these large numbers.

Technical detail

An integer overflow vulnerability in web content processing allows remote code execution through crafted input that exceeds integer bounds. The attack requires user interaction to view malicious web content, with the overflow leading to memory corruption and arbitrary code execution.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Apple · macOS
Related CVEs — Apple macOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2021-30657MEDIUMCVE-2021-30657EPSS 68.5%KEVCVE-2025-43300CRITICALCVE-2025-43300EPSS 65.2%KEVCVE-2023-41064HIGHCVE-2023-41064EPSS 53.4%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 51.5%KEVCVE-2021-30807HIGHCVE-2021-30807EPSS 28.8%KEV