Actively exploited · Published Aug 24, 2021 · Assigned by apple
CVE-2021-30952
High 8.8 Exploited
In plain English
A high-severity integer overflow in iOS and iPadOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on March 5, 2026). The chance it is exploited in the next 30 days is estimated at 7.0% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Mar 26, 2026.
Official description
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | webkit2gtk3 | 2.34.6-1.el8 | ALSA-2022:1777 |
| AlmaLinux:8 | webkit2gtk3-devel | 2.34.6-1.el8 | ALSA-2022:1777 |
| AlmaLinux:8 | webkit2gtk3-jsc | 2.34.6-1.el8 | ALSA-2022:1777 |
| AlmaLinux:8 | webkit2gtk3-jsc-devel | 2.34.6-1.el8 | ALSA-2022:1777 |
| Alpine:v3.20 | webkit2gtk | 2.34.4-r0 | ALPINE-CVE-2021-30952 |
| Debian:12 | webkit2gtk | 2.34.4-1 | DEBIAN-CVE-2021-30952 |
| Debian:13 | webkit2gtk | 2.34.4-1 | DEBIAN-CVE-2021-30952 |
| Debian:14 | webkit2gtk | 2.34.4-1 | DEBIAN-CVE-2021-30952 |
| Debian:12 | wpewebkit | 2.34.4-1 | DEBIAN-CVE-2021-30952 |
| Debian:13 | wpewebkit | 2.34.4-1 | DEBIAN-CVE-2021-30952 |
| Debian:14 | wpewebkit | 2.34.4-1 | DEBIAN-CVE-2021-30952 |
| Rocky Linux:8 | webkit2gtk3 | 0:2.34.6-1.el8 | RLSA-2022:1777 |
| Ubuntu:22.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2021-30952 |
| Ubuntu:24.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2021-30952 |
| Ubuntu:22.04:LTS | wpewebkit | no fix listed | UBUNTU-CVE-2021-30952 |
Affected products (as reported)
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT212975 x_refsource_MISC
- https://support.apple.com/en-us/HT212976 x_refsource_MISC
- https://support.apple.com/en-us/HT212978 x_refsource_MISC
- https://support.apple.com/en-us/HT212980 x_refsource_MISC
- https://support.apple.com/en-us/HT212982 x_refsource_MISC
- [oss-security] 20220121 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001 mailing-list, x_refsource_MLIST
- FEDORA-2022-25a98f5d55 vendor-advisory, x_refsource_FEDORA
- DSA-5061 vendor-advisory, x_refsource_DEBIAN
- DSA-5060 vendor-advisory, x_refsource_DEBIAN
- FEDORA-2022-f7366e60cb vendor-advisory, x_refsource_FEDORA
- https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30952 government-resource