Actively exploited · Published Aug 24, 2021 · Assigned by apple

CVE-2021-30900

High 7.8 Exploited

In plain English

A high-severity out-of-bounds write in iOS and iPadOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on March 30, 2023). The chance it is exploited in the next 30 days is estimated at 5.2% (higher than 93% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)5.2%top 7.5% of all CVEs

Exploited in the wildYesCISA KEV since Mar 30, 2023

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 20, 2023.

Official description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1, iOS 15.1 and iPadOS 15.1. A malicious application may be able to execute arbitrary code with kernel privileges.

Affected products (as reported)

Vendor	Product	Versions
Apple	iOS and iPadOS	unspecified – before 15.1
Apple	iOS and iPadOS	unspecified – before 14.8

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://support.apple.com/kb/HT212872 x_refsource_CONFIRM
https://support.apple.com/en-us/HT212867 x_refsource_MISC
https://support.apple.com/en-us/HT212868 x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30900 government-resource