CVE-2021-30666
Apple iOS WebKit Buffer Overflow Vulnerability
Description
CVE-2021-30666 is a high-severity buffer overflow vulnerability in Apple iOS WebKit. The flaw allows an attacker to execute arbitrary code by processing maliciously crafted web content through WebKit's HTML parser. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. With an EPSS score of 1.50% (80.9th percentile), CVE-2021-30666 specifically targets older iOS devices and represents a critical remote code execution threat through web-based attack vectors.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | iphone os | < 12.5.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT212341(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30666(Third Party Advisory, US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
This weakness occurs when software performs operations on a memory buffer without properly restricting read or write access to the intended boundaries. In CVE-2021-30666, a buffer overflow in WebKit allows maliciously crafted web content to write beyond allocated memory boundaries during HTML processing, potentially corrupting control flow data and enabling arbitrary code execution.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2021-30666 carries a CVSS 3.1 score of 8.8 (HIGH), indicating a severe threat to affected devices. The vulnerability is remotely exploitable over the network with low attack complexity and requires no authentication, though user interaction is needed. Successful exploitation results in high impact to confidentiality, integrity, and availability, as the buffer overflow can lead to arbitrary code execution within the context of the WebKit process. The EPSS score of 1.50% (80.9th percentile) indicates a notable probability of exploitation. Apple has acknowledged reports that this issue may have been actively exploited, specifically targeting older iOS devices limited to the iOS 12 branch.
Exploit Maturity
CVE-2021-30666 is confirmed as actively exploited through its inclusion in the CISA Known Exploited Vulnerabilities catalog. Apple has acknowledged reports that this issue may have been actively exploited in the wild. The EPSS score of 1.50% (80.9th percentile) indicates a notable probability of exploitation activity. No public exploit code was identified in the available references. Federal agencies were required to remediate by 2021-11-17 per CISA's binding operational directive. This vulnerability was disclosed alongside CVE-2021-30762, both targeting WebKit on older iOS devices.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Update affected devices to iOS 12.5.3 or later.
- Since this vulnerability specifically targets older iOS devices on the iOS 12 branch, ensure all legacy iPhones and iPads still in use receive the iOS 12.5.3 update promptly.
- For devices that cannot be updated, restrict web browsing capabilities through MDM profiles or parental controls, and deploy a managed browser with content filtering to limit exposure to malicious web content.
- Monitor web browsing activity on older iOS devices for signs of exploitation, including unexpected application behavior, browser crashes during normal usage, or suspicious network connections.
- Implement network-level web content inspection and threat prevention to detect and block malicious payloads targeting WebKit buffer overflow vulnerabilities before they reach vulnerable endpoints.
Technical Details
CVE-2021-30666 is a buffer overflow vulnerability in Apple's WebKit rendering engine that specifically affects iOS 12. The flaw is classified under CWE-119, indicating improper restriction of operations within memory buffer boundaries. According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the vulnerability is network-accessible with low complexity, requires no privileges but needs user interaction. The buffer overflow occurs during the processing of web content, where insufficient memory handling allows data to be written beyond the allocated buffer. This can overwrite adjacent memory including return addresses or function pointers, enabling an attacker to redirect execution flow and achieve arbitrary code execution. Apple addressed this issue with improved memory handling in iOS 12.5.3.
Frequently Asked Questions
Is CVE-2021-30666 being actively exploited?
Yes. CVE-2021-30666 is listed in the CISA Known Exploited Vulnerabilities catalog, and Apple has acknowledged reports of active exploitation in the wild. The EPSS score of 1.50% (80.9th percentile) confirms a notable exploitation probability.
What products are affected by CVE-2021-30666?
CVE-2021-30666 affects Apple iPhone OS versions prior to 12.5.3. This vulnerability specifically targets older iOS devices that are limited to the iOS 12 branch and impacts any application using WebKit for HTML rendering.
How do I fix CVE-2021-30666?
Apply updates per vendor instructions. Update affected devices to iOS 12.5.3 or later. For devices that cannot be updated, restrict web browsing capabilities and implement network-level content filtering to reduce exposure.
How severe is CVE-2021-30666?
CVE-2021-30666 has a CVSS 3.1 score of 8.8 (HIGH). It is a remotely exploitable buffer overflow in WebKit that enables arbitrary code execution through malicious web content, with confirmed active exploitation targeting older iOS devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.