Live › vulnerability › CVE-2021-30952
Go to dashboardApple's WebKit engine in Safari and other Apple operating systems has an integer overflow that a malicious web page can trigger. Successful exploitation lets an attacker run arbitrary code on the victim's device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Apple Multiple Products | vendor | – | – |
| apple safari | vendor | < 15.2 | 15.2 |
| apple ipados | vendor | < 15.2 | 15.2 |
| apple iphone os | vendor | < 15.2 | 15.2 |
| apple macos | vendor | >= 12.0, < 12.1 | 12.1 |
| apple tvos | vendor |
| < 15.2 |
| 15.2 |
| apple watchos | vendor | < 8.3 | 8.3 |
| fedoraproject fedora | vendor | = 34 | – |
| fedoraproject fedora | vendor | = 35 | – |
| debian linux | vendor | = 10.0 | – |
| debian linux | vendor | = 11.0 | – |
| webkitgtk | vendor | < 2.34.4 | 2.34.4 |
| wpewebkit wpe webkit | vendor | < 2.34.4 | 2.34.4 |
Check the installed OS and Safari versions against Apple's security content for CVE-2021-30952; unknown for exact affected build numbers.
Update Apple devices (macOS, iOS/iPadOS, watchOS, tvOS, Safari) to the latest version Apple has released; unknown for the specific fixed build from these sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2021-30952")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.