CVE-2021-30665
Memory Safety in Apple Iphone Os ≤ 12.5.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2021-30665 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Apple Iphone Os. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Security Account Manager (T1003.002); ranked in the top 10% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A memory corruption vulnerability, identified as CWE-787, affects multiple Apple platforms and stems from improper state management during the processing of web content. Impacted software includes watchOS prior to 7.4.1, iOS and iPadOS prior to 14.5.1, tvOS prior to 14.6, iOS 12.x prior to 12.5.3, and macOS Big Sur prior to 11.3.1. The flaw carries a CVSS score of 8.8 and enables out-of-bounds write operations when handling untrusted input.
An unauthenticated remote attacker can exploit the issue by supplying maliciously crafted web content that a user is tricked into processing, such as through a web browser or other web-rendering component. Successful exploitation grants arbitrary code execution with full read, write, and execution impact on the affected device.
Apple security advisories for the listed updates state that the vulnerability is resolved by applying the respective patches, which improve state management to prevent the memory corruption. The references detail the fixed versions for each platform and urge immediate installation to address the exposure.
Apple has noted reports indicating that this vulnerability may have been actively exploited in the wild prior to patching.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-17582
Vulnerability Data
A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code…
more
execution. Apple is aware of a report that this issue may have been actively exploited..
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability scanning and recording can discover out-of-bounds write flaws so they can be remediated.
Patching or replacing vulnerable software directly eliminates known instances of this coding weakness.
Secure-development practices (static analysis, bounds checking, code review) are the primary means of preventing out-of-bounds writes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.