CVE-2021-30665: Apple WebKit memory corruption allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a remotely reachable memory corruption flaw with confirmed active exploitation and KEV listing, though it requires user interaction and patches have long been available.

What it is

CVE-2021-30665 is an out-of-bounds write (CWE-787) in Apple's WebKit that was fixed through improved state management. Processing maliciously crafted web content can lead to arbitrary code execution, and Apple stated it was aware of a report that the issue may have been actively exploited. It affects iOS, iPadOS, macOS, tvOS and watchOS.

Impact

An attacker who gets a victim to load crafted web content can corrupt memory and potentially execute arbitrary code in the context of the affected component. Given the CVSS vector (C:H/I:H/A:H), successful exploitation can fully compromise confidentiality, integrity and availability on the device.

Attack surface

The flaw is reached over the network by rendering malicious web content, requiring no privileges but requiring user interaction (UI:R) such as visiting a page or viewing content that triggers WebKit. No authentication is needed.

Exploitation

Apple reported awareness of possible active exploitation, and CISA added it to the KEV catalog on 2021-11-03 with a 2021-11-17 remediation due date. EPSS 30-day probability is about 3.7 percent (89th percentile), and no ransomware campaign use is documented.

What to do

• Apply the vendor updates that fix this issue: watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, and macOS Big Sur 11.3.1 (or later).
• Prioritize patching internet-facing and user-facing Apple devices, especially those used for browsing or email, per the CISA KEV due date.
• Where immediate patching is not possible, restrict browsing to trusted sites and reduce exposure to untrusted web content on affected devices.
• Track affected device inventory against the fixed OS versions to confirm no unpatched endpoints remain.

Detection

• Monitor for exploitation attempts or crashes tied to WebKit content rendering on unpatched Apple devices.
• Check device OS versions against the fixed releases to identify unpatched assets.
• Review endpoint or MDM telemetry for unexpected process crashes or code execution originating from browser or web-content processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.