---
id: "CVE-2021-30666"
kind: "vulnerability"
aliases: ["CVE-2021-30666"]
title: "Apple iOS: Apple iOS WebKit Buffer Overflow Vulnerability"
severity: "high"
cvss: 8.8
epss: 0.02998
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Apple iOS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "ios", "iphone", "safari", "vendor", "webkit"]
not_affected_if: ["up-to-date-ios"]
published_at: "2021-09-08T15:15:13+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30666", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-30666", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30666", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Apple iOS: Apple iOS WebKit Buffer Overflow Vulnerability

Apple iOS WebKit has a buffer overflow that is triggered when the browser engine processes crafted web content. An attacker who gets a victim to load a malicious page can run code on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple iOS affected ? fixed ?

## How to check

Check the iOS version on the device under Settings > General > About; compare it with the fixed release in Apple's security notes (unknown from sources).

## Fix

Update iOS to a release that includes the Apple fix for CVE-2021-30666 (exact version unknown from sources); apply updates per vendor instructions as CISA requires.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30666
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-30666
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-30666

## From the sources

Apple iOS WebKit contains a buffer-overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_