CVEvulnerability
CVE-2021-30952
CISA Known Exploited Vulnerability
Apple Multiple Products Integer Overflow or Wraparound Vulnerability — Apple Multiple Products
Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.
- Added to KEV
- 2026-03-05
- Remediation due
- 2026-03-26
- Ransomware use
- Unknown
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Notes
- https://support.apple.com/en-us/HT212975 ; https://support.apple.com/en-us/HT212976 ; https://support.apple.com/en-us/HT212978 ; https://support.apple.com/en-us/HT212980 ; https://support.apple.com/en-us/HT212982 ; https://nvd.nist.gov/vuln/detail/CVE-2021-30952
- Status
- Analyzed
- Published
- 2021-08-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-190
Description
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.
Affected configurations
• apple safari (< 15.2)
• apple ipados (< 15.2)
• apple iphone os (< 15.2)
• apple macos (>= 12.0 < 12.1)
• apple tvos (< 15.2)
• apple watchos (< 8.3)
• fedoraproject fedora 34
• fedoraproject fedora 35
• debian debian linux 10.0
• debian debian linux 11.0
• webkitgtk webkitgtk (< 2.34.4)
• wpewebkit wpe webkit (< 2.34.4)
Related
Weakness · CWE (1)
- CWE-190 Integer Overflow or Wraparound weakness
References
- http://www.openwall.com/lists/oss-security/2022/01/21/2 Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EQVZ3CEMTINLBZ7PBC7WRXVEVCRHNSM/ Broken Link
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQKWD4BXRDD2YGR5AVU7H5J5PIQIEU6V/ Broken Link
- https://support.apple.com/en-us/HT212975 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT212976 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT212978 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT212980 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT212982 Release Notes, Vendor Advisory
- https://www.debian.org/security/2022/dsa-5060 Mailing List, Third Party Advisory
- https://www.debian.org/security/2022/dsa-5061 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/01/21/2 Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EQVZ3CEMTINLBZ7PBC7WRXVEVCRHNSM/ Broken Link
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQKWD4BXRDD2YGR5AVU7H5J5PIQIEU6V/ Broken Link
- https://support.apple.com/en-us/HT212975 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT212976 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT212978 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT212980 Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT212982 Release Notes, Vendor Advisory
- https://www.debian.org/security/2022/dsa-5060 Mailing List, Third Party Advisory
- https://www.debian.org/security/2022/dsa-5061 Mailing List, Third Party Advisory
- https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit Exploit, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30952 US Government Resource