{"schemaVersion":3,"id":"CVE-2021-30663","aliases":["UBUNTU-CVE-2021-30663","DEBIAN-CVE-2021-30663"],"status":"published","duplicateOf":null,"title":"Apple Multiple Products WebKit Integer Overflow Vulnerability","description":"An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution.","dates":{"published":"2021-09-08T14:49:41.000Z","modified":"2025-10-21T23:25:34.065Z","reserved":null,"kevAdded":["2021-11-03T00:00:00.000Z"],"kevDue":["2021-11-17T00:00:00.000Z"]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":4.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.03521,"percentile":0.89085,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.027999999999999553,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.03493},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03521,"percentile":0.89085}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.03493,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03521,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03521,"percentile":0.89085}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2021-11-17T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Apple Multiple Products WebKit Integer Overflow Vulnerability","description":"Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2021-30663","label":"nvd.nist.gov/vuln/detail/CVE-2021-30663"}],"vendor":"Apple","product":"Multiple Products","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2021-11-17T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Apple Multiple Products WebKit Integer Overflow Vulnerability","description":"Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2021-30663","label":"nvd.nist.gov/vuln/detail/CVE-2021-30663"}],"vendor":"Apple","product":"Multiple Products","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-190","name":"Integer Overflow or Wraparound","description":"The product performs a calculation that can\n         produce an integer overflow or wraparound when the logic\n         assumes that the resulting value will always be larger than\n         the original value. This occurs when an integer value is\n         incremented to a value that is too large to store in the\n         associated representation. When this occurs, the value may\n         become a very small or negative number.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/190.html"}],"affected":[{"vendor":"apple","product":"ipados","name":"ipados","label":"ipados","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 14.0, < 14.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 14.0, < 14.5.1","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"ipados","label":"Apple iPadOS","category":"os"}},"hubHref":"/vendor/apple/ipados"},{"vendor":"apple","product":"iphone_os","name":"iphone os","label":"iphone_os","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 12.5.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 14.0, < 14.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.5.3 | ≥ 14.0, < 14.5.1","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"ios","label":"Apple iOS","category":"os"}},"hubHref":"/vendor/apple/iphone_os"},{"vendor":"apple","product":"macos","name":"macos","label":"macos","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 11.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ unspecified, < 14.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ unspecified, < 12.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ unspecified, < 14.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ unspecified, < 14.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 11.0, < 11.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 11.3 | ≥ unspecified, < 14.5 | ≥ unspecified, < 12.5 | ≥ unspecified, < 14.6 | ≥ unspecified, < 14.1 | ≥ 11.0, < 11.3.1","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"macos","label":"Apple macOS","category":"os"}},"hubHref":"/vendor/apple/macos"},{"vendor":"apple","product":"safari","name":"safari","label":"safari","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 14.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 14.1.1","eol":null,"hubHref":"/vendor/apple/safari"},{"vendor":"apple","product":"tvos","name":"tvos","label":"tvos","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 14.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 14.6","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"tvos","label":"Apple tvOS","category":"os"}},"hubHref":"/vendor/apple/tvos"},{"vendor":"debian","product":"webkit2gtk","name":"webkit2gtk","label":"webkit2gtk","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/webkit2gtk","purlType":"deb","versions":[{"text":"< 2.32.3-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.32.3-1","eol":null,"hubHref":null},{"vendor":"debian","product":"wpewebkit","name":"wpewebkit","label":"wpewebkit","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/wpewebkit","purlType":"deb","versions":[{"text":"< 2.32.3-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.32.3-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"qtwebkit-opensource-src","name":"qtwebkit-opensource-src","label":"qtwebkit-opensource-src","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/qtwebkit-opensource-src","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"qtwebkit-source","name":"qtwebkit-source","label":"qtwebkit-source","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/qtwebkit-source","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"webkit2gtk","name":"webkit2gtk","label":"webkit2gtk","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/webkit2gtk","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 2.32.3-0ubuntu0.18.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.32.3-0ubuntu0.20.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 2.32.3-0ubuntu0.18.04.1 | < 2.32.3-0ubuntu0.20.04.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"webkitgtk","name":"webkitgtk","label":"webkitgtk","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/webkitgtk","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"wpewebkit","name":"wpewebkit","label":"wpewebkit","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/wpewebkit","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null}],"affectedCount":12,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://support.apple.com/en-us/HT212532","label":"support.apple.com/en-us/HT212532","hostname":"support.apple.com","tags":["X Refsource MISC","Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212534","label":"support.apple.com/en-us/HT212534","hostname":"support.apple.com","tags":["X Refsource MISC","Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212341","label":"support.apple.com/en-us/HT212341","hostname":"support.apple.com","tags":["X Refsource MISC","Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212335","label":"support.apple.com/en-us/HT212335","hostname":"support.apple.com","tags":["X Refsource MISC","Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212336","label":"support.apple.com/en-us/HT212336","hostname":"support.apple.com","tags":["X Refsource MISC","Release Notes","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30663","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30663","hostname":"www.cisa.gov","tags":["Government Resource","Third Party Advisory","US Government Resource"]},{"url":"https://ubuntu.com/security/CVE-2021-30663","label":"ubuntu.com/security/CVE-2021-30663","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-5024-1","label":"ubuntu.com/security/notices/USN-5024-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-30663","label":"www.cve.org/CVERecord?id=CVE-2021-30663","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog","hostname":"www.cisa.gov","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-30663","label":"security-tracker.debian.org/tracker/CVE-2021-30663","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["DSA-4945-1","MGASA-2021-0400","OPENSUSE-SU-2021:1101-1","OPENSUSE-SU-2021:2598-1","RHSA-2021:4381","RHSA-2025:10364","SUSE-SU-2021:2598-1","SUSE-SU-2021:2600-1","SUSE-SU-2021:2762-1","USN-5024-1"],"duplicates":[],"related":["OPENSUSE-SU-2021:1101-1","OPENSUSE-SU-2021:2598-1","SUSE-SU-2021:2598-1","SUSE-SU-2021:2600-1","SUSE-SU-2021:2762-1","USN-5024-1"]},"timeline":[{"kind":"published","date":"2021-09-08T14:49:41.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2021-11-03T00:00:00.000Z","label":"Added to CISA KEV","detail":"Apple Multiple Products WebKit Integer Overflow Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2021-11-17T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:25:34.065Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T15:48:06.761Z","stale":false,"partial":false}}