CVE-2021-30665

CVE-2021-30665 is a memory corruption flaw (CWE-787, out-of-bounds write) in the WebKit engine shared across Apple's operating systems, fixed through improved state management. It is triggered when a device processes maliciously crafted web content, for example when a user loads an attacker-controlled web page or other web-rendered content, which is reflected in the required user-interaction element of the CVSS vector. Successful exploitation may lead to arbitrary code execution on the device. Essentially all Apple devices running versions of iOS, iPadOS, macOS Big Sur, tvOS, or watchOS earlier than the patched releases were affected, spanning the bulk of Apple's active installed base at the time. Apple reported the issue was being actively exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03; EPSS assigns a 3.7% probability of exploitation in the next 30 days (89th percentile).

What to do: Upgrade iPhones and iPads to iOS/iPadOS 14.5.1 (or iOS 12.5.3 on devices that cannot run 14.x), Macs to macOS Big Sur 11.3.1, Apple TVs to tvOS 14.6, and Apple Watches to watchOS 7.4.1. Because exploitation occurs through crafted web content, patching is the only reliable mitigation; use MDM or device inventory to confirm no managed Apple devices remain on pre-fix OS versions and treat any stragglers as actively at risk.