Vulnerability record · CVE-2021-30869 · published 24 August 2021
CVE-2021-30869: Apple iOS, iPadOS and macOS type confusion allows kernel code execution
Apple · Ipados
A type confusion flaw in Apple iOS, iPadOS and macOS was addressed through improved state handling. A malicious application can exploit it to execute arbitrary code with kernel privileges, and Apple stated it was aware of in-the-wild exploitation at the time of disclosure.
Description
A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, Security Update 2021-006 Catalina. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of reports that an exploit for this issue exists in the wild.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityKernel-privilege code execution with confirmed in-the-wild exploitation and CISA KEV listing, though the local vector and required user interaction limit mass remote exploitation.
What it is
A type confusion flaw in Apple iOS, iPadOS and macOS was addressed through improved state handling. A malicious application can exploit it to execute arbitrary code with kernel privileges, and Apple stated it was aware of in-the-wild exploitation at the time of disclosure.
Impact
An attacker who gets a malicious app running on the device gains kernel-level code execution, effectively full control of the operating system and its protections.
Attack surface
The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), so the attacker must already have code running on the target and convince the user to trigger it; no network or remote vector is described.
Exploitation
CVE-2021-30869 is listed in CISA's Known Exploited Vulnerabilities catalog with a 2021-11-17 remediation due date, and Apple reported in-the-wild exploits; EPSS 30-day probability is about 4.1 percent (90th percentile).
What to do
- Apply the Apple security updates that fix this issue: iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, and Security Update 2021-006 Catalina.
- Prioritize patching devices that cannot run current OS versions, since older iOS and macOS releases are covered by separate updates.
- Restrict installation of untrusted or sideloaded applications and enforce app-store or managed-software policies to reduce the local attack path.
- Track CISA KEV remediation deadlines and verify patched status across iPhone, iPad and Mac fleets.
Detection
- Monitor for unexpected kernel-level code execution or privilege escalation attempts originating from application processes.
- Alert on installation or execution of unsigned, sideloaded or otherwise untrusted applications on managed Apple devices.
- Audit device OS versions against the fixed releases and flag endpoints still running vulnerable builds.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2021-30869 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Apple iOS, iPadOS, and macOS Type Confusion Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 17 November 2021.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://support.apple.com/en-us/HT212146 | Vendor Advisory |
| https://support.apple.com/en-us/HT212147 | Vendor Advisory |
| https://support.apple.com/en-us/HT212824 | Vendor Advisory |
| https://support.apple.com/en-us/HT212825 | Vendor Advisory |
| https://support.apple.com/en-us/HT212146 | Vendor Advisory |
| https://support.apple.com/en-us/HT212147 | Vendor Advisory |
| https://support.apple.com/en-us/HT212824 | Vendor Advisory |
| https://support.apple.com/en-us/HT212825 | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30869 | US Government Resource |
Track CVE-2021-30869 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-30869), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
