CVE-2021-30900: Apple iOS, iPadOS and macOS out-of-bounds write in kernel

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw gives kernel-level code execution and is in CISA's KEV catalog, but it requires local access and user interaction, so it is high rather than critical.

What it is

An out-of-bounds write in Apple iOS, iPadOS and macOS was fixed by improved bounds checking in iOS 14.8.1, iPadOS 14.8.1, iOS 15.1 and iPadOS 15.1. A malicious application can trigger the flaw to run code with kernel privileges. Because it yields kernel-level execution, it is a serious local privilege escalation primitive on affected Apple devices.

Impact

An attacker who gets a malicious app onto the device gains arbitrary code execution at kernel privilege, effectively full control of the operating system. That can defeat platform security controls and enable persistent compromise.

Attack surface

The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges needed (PR:N), so the flaw is reached by a malicious application the user installs or opens. No remote or network path is described in the record.

Exploitation

CVE-2021-30900 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2023-03-30), indicating exploitation in the wild; EPSS 30-day probability is about 5.2 percent (92nd percentile). No ransomware campaign use is recorded.

What to do

• Update to iOS 14.8.1, iPadOS 14.8.1, iOS 15.1, iPadOS 15.1 or later per Apple advisories HT212867, HT212868 and HT212872.
• Enforce a minimum OS version on managed iPhones, iPads and Macs and block or flag devices below the fixed builds.
• Restrict app installation to trusted sources and review or block sideloaded and unmanaged applications.
• Limit local user rights and application execution where feasible to reduce the impact of a malicious app.
• Track CISA KEV remediation deadlines and confirm patching of all affected Apple devices.

Detection

• Inventory Apple devices and alert on OS versions below the fixed releases (iOS/iPadOS 14.8.1, 15.1 and corresponding macOS builds).
• Monitor for unexpected kernel-level crashes, panics or memory corruption reports that may indicate exploitation attempts.
• Review application installation and execution telemetry for untrusted or sideloaded apps on managed devices.
• Correlate endpoint alerts for privilege escalation or kernel code execution on Apple endpoints with known vulnerable OS versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.