{"id":"CVE-2021-30952","kind":"vulnerability","aliases":["CVE-2021-30952"],"related":[],"title":"An integer overflow was addressed with improved input validation","description":"Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Apple's WebKit engine in Safari and other Apple operating systems has an integer overflow that a malicious web page can trigger. Successful exploitation lets an attacker run arbitrary code on the victim's device.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2026-03-05T00:00:00+00:00","products":[{"name":"Apple Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"apple safari","fixed":["15.2"],"affected":"< 15.2","ecosystem":"vendor"},{"name":"apple ipados","fixed":["15.2"],"affected":"< 15.2","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["15.2"],"affected":"< 15.2","ecosystem":"vendor"},{"name":"apple macos","fixed":["12.1"],"affected":">= 12.0, < 12.1","ecosystem":"vendor"},{"name":"apple tvos","fixed":["15.2"],"affected":"< 15.2","ecosystem":"vendor"},{"name":"apple watchos","fixed":["8.3"],"affected":"< 8.3","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 34","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 35","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"webkitgtk","fixed":["2.34.4"],"affected":"< 2.34.4","ecosystem":"vendor"},{"name":"wpewebkit wpe webkit","fixed":["2.34.4"],"affected":"< 2.34.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","exploited","ios","macos","other","safari","webkit"],"not_affected_if":["unknown"],"how_to_check":"Check the installed OS and Safari versions against Apple's security content for CVE-2021-30952; unknown for exact affected build numbers.","fix":"Update Apple devices (macOS, iOS/iPadOS, watchOS, tvOS, Safari) to the latest version Apple has released; unknown for the specific fixed build from these sources.","status":"open","published_at":"2021-08-24T19:15:21+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:39:13+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T20:39:13Z","model":"claude-haiku-5-5","output":{"fix":"Update Apple devices (macOS, iOS/iPadOS, watchOS, tvOS, Safari) to the latest version Apple has released; unknown for the specific fixed build from these sources.","reach":"internet","summary":"Apple's WebKit engine in Safari and other Apple operating systems has an integer overflow that a malicious web page can trigger. Successful exploitation lets an attacker run arbitrary code on the victim's device.","category":"other","who_cares":["apple","macos","ios","safari","webkit"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the device after the user visits a malicious web page.","analyst_note":"Confirm fixed build numbers per Apple product from Apple's security advisory for CVE-2021-30952 (support.apple.com/en-us/HT212976 or similar); sources do not list versions.","how_to_check":"Check the installed OS and Safari versions against Apple's security content for CVE-2021-30952; unknown for exact affected build numbers.","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000464,"input_tokens":2558,"output_tokens":416,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':128C '-2021':11A,14A '-30952':12A,15A '22':127C 'action':118C 'address':5A 'appl':44B,51B,59B,86C 'apple':16A,19A,21A,23A,26A,28A,30A 'appli':119C 'applic':125C 'arbitrari':79B,113C 'attack':77B 'bod':126C 'cisa':116C 'cloud':131C 'code':80B,114C 'contain':93C 'content':108C 'craft':106C 'cve':10A,13A 'debian':36A,38A 'devic':85B 'discontinu':134C 'due':100C 'engin':54B 'execut':115C 'exploit':45B,74B 'fedora':33A,35A 'fedoraproject':32A,34A 'follow':124C 'guidanc':129C 'improv':7A 'input':8A 'instruct':123C 'integ':2A,64B,95C 'io':46B 'ipado':90C 'ipados':22A 'iphone':24A 'lead':111C 'let':75B 'linux':37A,39A 'maco':47B,88C 'macos':27A 'malici':68B,105C 'may':110C 'mitig':120C,140C 'multiple':17A 'oper':60B 'os':25A 'overflow':3A,65B,96C 'page':70B 'per':121C 'process':103C 'product':138C 'products':18A 'requir':117C 'run':78B 'safari':20A,49B,56B,89C 'servic':132C 'success':73B 'system':61B 'trigger':72B 'tvos':29A,87C 'unavail':142C 'use':135C 'valid':9A 'vendor':122C 'victim':83B 'vulner':99C 'watcho':92C 'watchos':31A 'web':69B,107C 'webkit':43A,50B,53B 'webkitgtk':40A 'wpe':42A 'wpewebkit':41A 'wraparound':98C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-08-24T19:15:21+00:00","kev":{"dateAdded":"2026-03-05","dueDate":"2026-03-26","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-30952","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30952","severity":null,"published_at":"2026-03-05T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-30952","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30952","severity":null,"published_at":"2021-08-24T19:15:21+00:00","modified_at":"2026-06-17T03:51:12+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}