Vulnerability record · CVE-2021-30983 · published 24 August 2021
CVE-2021-30983: Apple iOS and iPadOS buffer overflow allows kernel code execution
Apple · Ipados
A buffer overflow in Apple iOS and iPadOS was fixed by improved memory handling in iOS 15.2 and iPadOS 15.2. Successful exploitation lets an application execute arbitrary code with kernel privileges, so the flaw crosses a major security boundary on the device.
Description
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 15.2 and iPadOS 15.2. An application may be able to execute arbitrary code with kernel privileges.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityIt is listed in CISA KEV with confirmed exploitation and yields kernel code execution, though it requires local user interaction and a patch has long been available.
What it is
A buffer overflow in Apple iOS and iPadOS was fixed by improved memory handling in iOS 15.2 and iPadOS 15.2. Successful exploitation lets an application execute arbitrary code with kernel privileges, so the flaw crosses a major security boundary on the device.
Impact
An attacker gains kernel-level code execution from an application context, which can bypass OS protections and fully compromise the device. The CVSS vector rates confidentiality, integrity and availability impact as high.
Attack surface
The vector is local (AV:L) with no privileges required (PR:N) but user interaction required (UI:R), meaning the victim must open or trigger a crafted application or file. It is not remotely reachable without that local interaction.
Exploitation
CISA added it to the Known Exploited Vulnerabilities catalog on 2022-06-27 with a 2022-07-18 remediation due date, indicating real-world exploitation; EPSS 30-day probability is about 2.9 percent (86th percentile). No ransomware campaign use is recorded.
What to do
- Update to iOS 15.2 or iPadOS 15.2 or later per Apple's advisory HT212976.
- Enforce a minimum OS version for managed iPhone and iPad fleets and block or restrict older versions.
- Restrict installation of untrusted applications and profiles on managed devices.
- Treat the CISA KEV due date as a hard patch deadline and track compliance.
- Monitor vendor advisories for follow-up fixes to the same memory-handling code.
Detection
- Alert on devices reporting iOS or iPadOS versions below 15.2 in MDM inventory.
- Hunt for unexpected kernel panics, crashes or reboots that may follow memory corruption exploitation.
- Monitor for anomalous process behavior or privilege escalation attempts originating from application processes.
- Review application install and sideloading events for untrusted or unexpected sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2021-30983 to the Known Exploited Vulnerabilities catalog on 27 June 2022 as "Apple iOS and iPadOS Buffer Overflow Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 18 July 2022.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://support.apple.com/en-us/HT212976 | Release NotesVendor Advisory |
| https://support.apple.com/en-us/HT212976 | Release NotesVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30983 | US Government Resource |
Track CVE-2021-30983 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-30983), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
