CVE-2021-30883: Apple iOS/iPadOS/macOS/tvOS/watchOS memory corruption kernel code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityConfirmed in-the-wild exploitation and KEV listing raise urgency, but the local attack vector and required user interaction keep it below critical.

What it is

An out-of-bounds write memory corruption flaw in Apple operating systems was fixed with improved memory handling. Successful exploitation lets an application execute arbitrary code with kernel privileges, and Apple stated it was aware of a report that the issue may have been actively exploited.

Impact

An attacker who gets a malicious application running on the device can execute arbitrary code at kernel level, effectively taking full control of the underlying OS. That breaks the platform's core security boundary and enables persistent, privileged compromise.

Attack surface

The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), so the flaw is reached by running a crafted application on the target device rather than over the network. No authentication is needed, but the victim must trigger the malicious app or content.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-05-23, and Apple's advisory states the issue may have been actively exploited; EPSS gives a 30-day exploitation probability of about 14.7 percent (96th percentile). No ransomware campaign use is documented.

What to do

• Apply the Apple updates that fix this issue: iOS 15.0.2 and iPadOS 15.0.2, iOS 14.8.1 and iPadOS 14.8.1, macOS Monterey 12.0.1, macOS Big Sur 11.6.1, tvOS 15.1, and watchOS 8.1.
• Prioritize patching internet-facing and high-value Apple devices first, given confirmed in-the-wild exploitation and KEV listing.
• Enforce a policy that only signed, vetted applications from trusted sources can be installed, reducing the chance of a malicious app reaching the vulnerable code path.
• Track device OS versions centrally and report on any endpoints still below the fixed releases.

Detection

• Monitor for unexpected kernel-level crashes or panics on Apple endpoints, which can accompany memory corruption exploitation.
• Alert on installation or execution of unsigned or sideloaded applications outside approved distribution channels.
• Correlate endpoint telemetry for processes gaining kernel privileges or unusual system-call behavior following app launches.
• Audit device inventory against the fixed OS versions to find unpatched assets.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.