---
id: "CVE-2021-30952"
kind: "vulnerability"
aliases: ["CVE-2021-30952"]
title: "An integer overflow was addressed with improved input validation"
severity: "high"
cvss: 8.8
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "Apple Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "apple safari", "fixed": ["15.2"], "affected": "< 15.2", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["15.2"], "affected": "< 15.2", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["15.2"], "affected": "< 15.2", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["12.1"], "affected": ">= 12.0, < 12.1", "ecosystem": "vendor"}, {"name": "apple tvos", "fixed": ["15.2"], "affected": "< 15.2", "ecosystem": "vendor"}, {"name": "apple watchos", "fixed": ["8.3"], "affected": "< 8.3", "ecosystem": "vendor"}, {"name": "fedoraproject fedora", "fixed": [], "affected": "= 34", "ecosystem": "vendor"}, {"name": "fedoraproject fedora", "fixed": [], "affected": "= 35", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 11.0", "ecosystem": "vendor"}, {"name": "webkitgtk", "fixed": ["2.34.4"], "affected": "< 2.34.4", "ecosystem": "vendor"}, {"name": "wpewebkit wpe webkit", "fixed": ["2.34.4"], "affected": "< 2.34.4", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apple", "exploited", "ios", "macos", "other", "safari", "webkit"]
not_affected_if: ["unknown"]
published_at: "2021-08-24T19:15:21+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30952", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30952", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# An integer overflow was addressed with improved input validation

Apple's WebKit engine in Safari and other Apple operating systems has an integer overflow that a malicious web page can trigger. Successful exploitation lets an attacker run arbitrary code on the victim's device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple Multiple Products affected ? fixed ?
- vendor:apple safari affected < 15.2 fixed 15.2
- vendor:apple ipados affected < 15.2 fixed 15.2
- vendor:apple iphone os affected < 15.2 fixed 15.2
- vendor:apple macos affected >= 12.0, < 12.1 fixed 12.1
- vendor:apple tvos affected < 15.2 fixed 15.2
- vendor:apple watchos affected < 8.3 fixed 8.3
- vendor:fedoraproject fedora affected = 34 fixed ?
- vendor:fedoraproject fedora affected = 35 fixed ?
- vendor:debian linux affected = 10.0 fixed ?
- vendor:debian linux affected = 11.0 fixed ?
- vendor:webkitgtk affected < 2.34.4 fixed 2.34.4
- vendor:wpewebkit wpe webkit affected < 2.34.4 fixed 2.34.4

## How to check

Check the installed OS and Safari versions against Apple's security content for CVE-2021-30952; unknown for exact affected build numbers.

## Fix

Update Apple devices (macOS, iOS/iPadOS, watchOS, tvOS, Safari) to the latest version Apple has released; unknown for the specific fixed build from these sources.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30952
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-30952

## From the sources

Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_