CVE-2021-1871

Advisory lineage Upstream: 0 Downstream: 15
Analyzed
Published: 02 Apr 2021, 18:06
Last modified:21 Oct 2025, 23:25

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
0.79% LOW
1% probability -0.06%
KEV
Listed
CISA
1 listing
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

02 Apr 2021, 18:06
Published
Vulnerability first disclosed
03 Nov 2021, 00:00
Added to CISA KEV
Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
17 Nov 2021, 00:00
CISA Remediation Due
Apply updates per vendor instructions.
21 Oct 2025, 23:25
Last Modified
Vulnerability information updated

Description

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 0.79%• Percentile: 74%

Affected Systems

  • Unknown•iOS and iPadOS

    ≥ unspecified, < 14.4

  • apple•ipados

    < 14.4

  • apple•iphone_os

    < 14.4

  • apple•mac_os_x

    ≥ 10.15, < 10.15.7 | 10.15.7 | 10.15.7:security_update_2020 | 10.15.7:supplemental_update

  • Unknown•macOS

    ≥ 11.0.1, < 11.2 | ≥ unspecified, < 11.2

  • debian•debian_linux

    10.0

  • fedoraproject•fedora

    33

References (5)