CVE-2021-30665highunder attackCWE-787

CVE-2021-30665: high-severity vulnerability in Apple macOS

Published · Updated

Follow this CVE+ Monitor macOS+ Monitor webkit2gtk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 3.7%
from disclosure to weapon
Published on NVDSep 8
CISA KEV+56d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products (9 components)
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6
none_available: Affected
Fixed
3 products (70 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux Server (v. 7 ELS) · Red Hat Enterprise Linux Server Optional (v. 7 ELS)
fix ↗
Not affected
4 products (436 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat CodeReady Linux Builder (v. 8) · Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux 9
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

A memory corruption flaw in Apple devices allows attackers to run malicious code by tricking users into viewing specially crafted web content. This is a serious vulnerability that Apple knows has been actively exploited in the wild.

Technical detail

Out-of-bounds memory write vulnerability (CWE-787) in web content processing on Apple platforms (iOS, macOS, watchOS, tvOS). The attack vector is network-based requiring user interaction to view malicious web content; exploitation leads to arbitrary code execution with the privileges of the affected application. Addressed through improved state management in specified OS versions.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Apple · macOS
Related CVEs — Apple macOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2021-30657MEDIUMCVE-2021-30657EPSS 68.5%KEVCVE-2025-43300CRITICALCVE-2025-43300EPSS 65.2%KEVCVE-2023-41064HIGHCVE-2023-41064EPSS 53.4%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 51.5%KEVCVE-2021-30807HIGHCVE-2021-30807EPSS 28.8%KEV