CVE-2021-30666: Apple iOS WebKit buffer overflow allows arbitrary code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCISA KEV listing and Apple's acknowledgement of possible active exploitation raise urgency, though the CVSS score is 8.8 and EPSS is modest.

What it is

A memory buffer overflow in Apple iOS WebKit is triggered by processing maliciously crafted web content and was fixed in iOS 12.5.3. Apple stated it was aware of a report that the issue may have been actively exploited, making it a real-world risk to unpatched devices.

Impact

An attacker can achieve arbitrary code execution in the context of the affected WebKit process, potentially leading to full compromise of the device depending on the exploit chain. The CVSS vector indicates high confidentiality, integrity, and availability impact.

Attack surface

The flaw is reachable over the network via malicious web content rendered by WebKit, requiring user interaction such as visiting a crafted page. No authentication or privileges are needed on the target device.

Exploitation

The vulnerability is listed in CISA KEV with a due date of 2021-11-17, and Apple acknowledged possible active exploitation. EPSS probability is about 3% for the next 30 days, but KEV status confirms observed exploitation activity.

What to do

• Update affected Apple devices to iOS 12.5.3 or later as directed by Apple.
• Prioritize patching for devices that cannot be upgraded beyond iOS 12, since this fix targets that branch.
• Enforce web content filtering or disable JavaScript in high-risk browsing contexts where feasible.
• Monitor vendor advisories for any follow-up patches or additional affected versions.

Detection

• Hunt for iOS devices reporting versions below 12.5.3 in MDM or asset inventory.
• Review web proxy or DNS logs for access to known exploit-hosting domains if threat intelligence is available.
• Correlate unusual crashes or memory corruption reports from WebKit or Safari on unpatched devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.