CVE-2021-30952: Apple Multiple Products Integer Overflow or Wraparound Vulnerability
Vulnerability summary
CVE-2021-30952 is a high (CVSS 8.8) Integer Overflow or Wraparound vulnerability in Apple Multiple Products. It is known to be exploited: CISA lists it, first on 05-03-2026. EPSS estimates a 6.96% chance of exploitation in the next 30 days, higher than 94% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 10 · Related 5Timeline
- 24-08-2021PublishedVulnerability first disclosed.
- 05-03-2026Added to CISA KEVApple Multiple Products Integer Overflow or Wraparound Vulnerability
- 06-03-2026Last modifiedVulnerability information updated.
- 26-03-2026CISA remediation dueApply mitigations per vendor instructions.
Description
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
6.96%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 6.96% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 05-03-2026
- Federal due date
- 26-03-2026
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. support.apple.com/en-us/HT212975 support.apple.com/en-us/HT212976 support.apple.com/en-us/HT212978 support.apple.com/en-us/HT212980 support.apple.com/en-us/HT212982 nvd.nist.gov/vuln/detail/CVE-2021-30952
Public exploits
1 foundExploit Reference (cloud.google.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Apple7 products
- ios and ipados≥ unspecified, < 15.2
- ipados< 15.2
- iphone_os< 15.2
- macos≥ unspecified, < 12.1 | ≥ unspecified, < 15.2 | ≥ 12.0, < 12.1
- safari< 15.2
Ubuntu5 products
- qtwebkit-opensource-srcAll versions (No fix recorded)
- qtwebkit-sourceAll versions (No fix recorded)
- webkit2gtkAll versions (No fix recorded) | < 2.34.4-0ubuntu0.20.04.1
- webkitgtkAll versions (No fix recorded)
- wpewebkitAll versions (No fix recorded)
Debian3 products
- webkit2gtk< 2.34.4-1
- wpewebkit< 2.34.4-1
- debian_linuxEOL10.0 | 11.0
Fedoraproject1 product
- fedoraEOL34 | 35
Webkitgtk1 product
- webkitgtk< 2.34.4
Wpewebkit1 product
- wpe_webkit< 2.34.4
6 vendors · 18 products
References
18 links
www.debian.org/security/2022/dsa-5061Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory- www.debian.org/security/2022/dsa-5060Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory
Show all 18 references
- cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kitThird Party AdvisoryExploit
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30952Government ResourceUS Government Resource