CVE-2021-30858: Apple iOS, iPadOS, macOS Use-After-Free Vulnerability

CVSS: 8.8v3.1HighKEVAnalyzed

AliasesMGASA-2021-0447RHSA-2021:4097RHSA-2021:4686+5 more

Published 24-08-2021Last modified 21-10-2025

Vulnerability summary

CVE-2021-30858 is a high (CVSS 8.8) Use After Free vulnerability in Apple iOS, iPadOS, and macOS. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 13.38% chance of exploitation in the next 30 days, higher than 96.3% of scored vulnerabilities.

Overall risk

85/100

0100

Critical · default modelHow is this calculated?

CVSS score

8.8/10

010

High · v3.1 (CVE.org)

EPSS score

13.38%

0%100%

Medium · 0.00 pp in 30 days

KEVListedCISA

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 14 · Related 11

DSA-4975-1 DSA-4976-1 MGASA-2021-0498 OPENSUSE-SU-2021:1369-1 OPENSUSE-SU-2021:3353-1 OPENSUSE-SU-2022:0182-1+8 more

Timeline

24-08-2021
PublishedVulnerability first disclosed.
03-11-2021
Added to CISA KEVApple iOS, iPadOS, macOS Use-After-Free Vulnerability
17-11-2021
CISA remediation dueApply updates per vendor instructions.
21-10-2025
Last modifiedVulnerability information updated.

Description

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.18.8v2.06.8

EPSS trend

Probability

13.38%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 13.38% on 19-09-2026

19-09-202619-10-2026

EPSS score

13.38%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 03-11-2021
Federal due date: 17-11-2021

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2021-30858

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Redhat17 products

webkit2gtk3< 0:2.30.4-3.el8_4 | < 0:2.24.4-4.el8_1 | < 0:2.24.4-4.el8_2
webkit2gtk3-debuginfo< 0:2.30.4-3.el8_4 | < 0:2.24.4-4.el8_1 | < 0:2.24.4-4.el8_2
webkit2gtk3-debugsource< 0:2.30.4-3.el8_4 | < 0:2.24.4-4.el8_1 | < 0:2.24.4-4.el8_2
webkit2gtk3-devel< 0:2.30.4-3.el8_4 | < 0:2.24.4-4.el8_1 | < 0:2.24.4-4.el8_2
webkit2gtk3-devel-debuginfo< 0:2.30.4-3.el8_4 | < 0:2.24.4-4.el8_1 | < 0:2.24.4-4.el8_2

Show all 17

Ubuntu5 products

qtwebkit-opensource-srcAll versions (No fix recorded)
qtwebkit-sourceAll versions (No fix recorded)
webkit2gtk< 2.32.4-0ubuntu0.18.04.1 | < 2.32.4-0ubuntu0.20.04.1 | All versions (No fix recorded)
webkitgtkAll versions (No fix recorded)
wpewebkitAll versions (No fix recorded)

Apple4 products

ios≥ unspecified, < 14.8
ipados≥ 13.1, < 14.8
iphone_os< 12.5.5 | ≥ 13.0, < 14.8
macos≥ unspecified, < 11.6 | < 11.6

Debian3 products

webkit2gtk< 2.32.4-1
wpewebkit< 2.32.4-1
debian_linuxEOL10.0 | 11.0

Fedoraproject1 product

fedoraEOL33 | 34

Mageia1 product

webkit2< 2.32.4-1.mga8

6 vendors · 31 products

References

43 links

support.apple.com/en-us/HT212804X Refsource MISCThird Party Advisory
support.apple.com/en-us/HT212807X Refsource MISCThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/27Mailing ListX Refsource FULLDISCThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/25Mailing ListX Refsource FULLDISCThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/29Mailing ListX Refsource FULLDISCThird Party Advisory
www.openwall.com/lists/oss-security/2021/09/20/1Mailing ListX Refsource MLIST
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORARelease Notes
seclists.org/fulldisclosure/2021/Sep/38Mailing ListX Refsource FULLDISCThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/39Mailing ListX Refsource FULLDISCThird Party Advisory
www.debian.org/security/2021/dsa-4975Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory

Show all 43 references

www.debian.org/security/2021/dsa-4976Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory
support.apple.com/kb/HT212824X Refsource CONFIRMThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/50Mailing ListX Refsource FULLDISCThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORARelease Notes
www.openwall.com/lists/oss-security/2021/10/26/9Mailing ListX Refsource MLIST
www.openwall.com/lists/oss-security/2021/10/27/1Mailing ListX Refsource MLIST
www.openwall.com/lists/oss-security/2021/10/27/2Mailing ListX Refsource MLIST
www.openwall.com/lists/oss-security/2021/10/27/4Mailing ListX Refsource MLIST
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30858Government ResourceUS Government Resource
advisories.mageia.org/MGASA-2021-0447.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=29479REPORT
webkitgtk.org/security/WSA-2021-0005.htmlWEBARTICLEREPORT
webkitgtk.org/2021/09/17/webkitgtk2.32.4-released.htmlWEB
access.redhat.com/errata/RHSA-2021:4097Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2006099REPORT
bugzilla.redhat.com/show_bug.cgi?id=2010825REPORT
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4097.jsonAdvisory
access.redhat.com/security/cve/CVE-2021-30858REPORT
www.cve.org/CVERecord?id=CVE-2021-30858AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2021-30858Advisory
www.openwall.com/lists/oss-security/2021/09/20/1ARTICLE
www.cisa.gov/known-exploited-vulnerabilities-catalogARTICLEREPORT
access.redhat.com/errata/RHSA-2021:4686Advisory
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4686.jsonAdvisory
access.redhat.com/errata/RHSA-2022:0059Advisory
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0059.jsonAdvisory
access.redhat.com/errata/RHSA-2022:0075Advisory
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0075.jsonAdvisory
ubuntu.com/security/CVE-2021-30858REPORT
webkitgtk.org/security/WSA-2021-0006.htmlREPORT
ubuntu.com/security/notices/USN-5087-1Advisory
security-tracker.debian.org/tracker/CVE-2021-30858Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities