CVE-2021-30952
Apple Multiple Products Integer Overflow or Wraparound Vulnerability
Description
CVE-2021-30952 is a HIGH severity integer overflow vulnerability (CWE-190) in Apple's WebKit browser engine. Processing maliciously crafted web content may lead to arbitrary code execution due to an integer overflow that was addressed with improved input validation. The vulnerability was fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2, iPadOS 15.2, and watchOS 8.3. With a CVSS 3.1 score of 7.8 and a vector of AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, the flaw requires local access and user interaction but has low attack complexity and high impact across confidentiality, integrity, and availability. CISA added CVE-2021-30952 to the Known Exploited Vulnerabilities catalog on March 5, 2026, with a remediation deadline of March 26, 2026. The EPSS score of 0.016 (1.6th percentile) reflects limited broad exploitation, though the KEV listing confirms that targeted attacks leveraging this vulnerability have been observed.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | safari | < 15.2 |
| apple | ipados | < 15.2 |
| apple | iphone os | < 15.2 |
| apple | macos | >= 12.0, < 12.1 |
| apple | tvos | < 15.2 |
| apple | watchos | < 8.3 |
| fedoraproject | fedora | 34; 35 |
| debian | debian linux | 10.0; 11.0 |
| webkitgtk | webkitgtk | < 2.34.4 |
| wpewebkit | wpe webkit | < 2.34.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.openwall.com/lists/oss-security/2022/01/21/2(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EQVZ3CEMTINLBZ7PBC7WRXVEVCRHNSM/(Broken Link)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQKWD4BXRDD2YGR5AVU7H5J5PIQIEU6V/(Broken Link)
- https://support.apple.com/en-us/HT212975(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT212976(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT212978(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT212980(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT212982(Release Notes, Vendor Advisory)
- https://www.debian.org/security/2022/dsa-5060(Mailing List, Third Party Advisory)
- https://www.debian.org/security/2022/dsa-5061(Mailing List, Third Party Advisory)
- https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30952(US Government Resource)
Weakness Type
CWE-190: Integer Overflow or Wraparound
Integer Overflow or Wraparound (CWE-190) is a vulnerability class where an arithmetic operation produces a numeric value that exceeds the maximum size of the integer type used to store it. When an integer overflows, the value wraps around to a small or negative number, which can lead to unexpected program behavior. In security-critical code, integer overflows frequently result in incorrect buffer size calculations, leading to heap or stack buffer overflows that attackers can exploit for arbitrary code execution.
In CVE-2021-30952, an integer overflow in the WebKit rendering engine occurs during the processing of specially crafted web content. The overflow causes an incorrect size calculation in a memory allocation or buffer operation, resulting in a buffer that is smaller than expected. When WebKit subsequently writes data into this undersized buffer, a heap buffer overflow occurs, corrupting adjacent memory. An attacker who controls the web content can carefully craft the overflow to achieve precise memory corruption, enabling arbitrary code execution within the browser process. Apple addressed the issue with improved input validation that prevents the integer overflow from occurring by checking for overflow conditions before performing the arithmetic operation.
Impact Analysis
CVE-2021-30952 carries a CVSS 3.1 base score of 7.8 (HIGH), with the local attack vector reflecting the requirement for user interaction with malicious content.
Confidentiality (High): Successful exploitation grants the attacker code execution within the browser or application process that renders web content using WebKit. This provides access to all data accessible to that process, including authentication tokens, browsing data, and potentially data from other applications through inter-process communication mechanisms on Apple platforms.
Integrity (High): Arbitrary code execution allows the attacker to modify data within the compromised process, inject malicious content, alter application behavior, and potentially persist malicious code on the device. On platforms where the WebKit process has broader system access, the integrity impact may extend beyond the browser.
Availability (High): At minimum, exploitation causes the WebKit process to crash. Successful code execution may allow the attacker to terminate processes, consume system resources, or otherwise degrade device availability. On watchOS and tvOS devices with more constrained resources, the availability impact may be more pronounced.
Scope (Unchanged): The vulnerability's direct impact is confined to the WebKit process boundary. However, the broad range of affected platforms (iOS, iPadOS, macOS, tvOS, watchOS) means that the vulnerability provides a code execution primitive on nearly every Apple device type. When chained with sandbox escape or privilege escalation vulnerabilities, the integer overflow can serve as the initial entry point for full device compromise.
Exploit Maturity
Active Exploitation: CVE-2021-30952 is confirmed as actively exploited. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on March 5, 2026, with a federal remediation deadline of March 26, 2026. The vulnerability has been associated with targeted exploitation campaigns against specific individuals.
Ransomware Association: CVE-2021-30952 is not associated with ransomware campaigns. Integer overflow vulnerabilities in WebKit are typically used in targeted surveillance and espionage operations rather than mass-distribution malware campaigns.
Public Exploits: Security researchers have published technical analyses of the integer overflow condition and its exploitation potential. The vulnerability was disclosed as part of Apple's December 2021 security updates, and subsequent research has detailed the memory corruption mechanism. Full exploitation chains combining this vulnerability with sandbox escape primitives have been documented in the threat intelligence community.
EPSS Context: The EPSS score of 0.016 (1.6th percentile) places this vulnerability in the lower range of exploitation probability. This reflects the targeted nature of WebKit exploitation and the requirement for user interaction, rather than a fundamentally low risk level. Organizations with users who may be targets of sophisticated threat actors should treat this vulnerability as high priority.
KEV Deadline: The CISA remediation deadline is March 26, 2026. All Apple devices should be updated to the patched software versions as soon as possible.
Remediation
-
Update to patched Apple software versions. Install tvOS 15.2 or later, macOS Monterey 12.1 or later, Safari 15.2 or later, iOS 15.2 or later, iPadOS 15.2 or later, and watchOS 8.3 or later. These updates include improved input validation that prevents the integer overflow from occurring.
-
Enable automatic updates on all Apple devices. Configure iOS, iPadOS, macOS, tvOS, and watchOS devices to automatically install security updates. Enable Rapid Security Responses on supported platforms for time-critical patches.
-
Enforce minimum OS versions through MDM. Organizations managing Apple device fleets should use Mobile Device Management to enforce minimum OS version requirements and restrict corporate resource access from devices running vulnerable software.
-
Implement web content filtering. Deploy network-level content filtering to reduce exposure to malicious web content. While not a substitute for patching, content filtering provides defense-in-depth against web-based exploitation vectors.
-
Educate high-risk users. Users who may be targets of sophisticated threat actors (executives, researchers, journalists, administrators with privileged access) should be specifically informed about the importance of keeping their devices updated and exercising caution with web links from untrusted sources.
-
Review device inventory for all affected platforms. Since the vulnerability spans iOS, iPadOS, macOS, tvOS, and watchOS, ensure that the remediation effort covers all Apple device types in the organization, including Apple TVs and Apple Watches that may be overlooked in standard patch management processes.
Technical Details
CVE-2021-30952 is an integer overflow vulnerability in Apple's WebKit rendering engine that affects all platforms using WebKit for web content rendering: iOS, iPadOS, macOS (via Safari), tvOS, and watchOS. The vulnerability resides in the processing logic for specific web content structures where an arithmetic operation on user-controlled values produces an integer overflow.
The integer overflow occurs when WebKit calculates the size of a buffer or memory allocation based on values derived from the web content being processed. When the arithmetic operation overflows the integer type's maximum value, the result wraps around to a much smaller number. This causes WebKit to allocate a buffer that is significantly smaller than the actual data that will be written to it. The subsequent write operation overflows the undersized buffer, corrupting adjacent heap memory.
The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a local attack vector with user interaction required. In practice, this means the user must open a malicious web page or web content in an application that uses WebKit for rendering. The low attack complexity reflects that once the exploit is constructed, triggering it is straightforward. The high impact across confidentiality, integrity, and availability reflects the arbitrary code execution capability.
Apple's fix addresses the root cause by adding input validation checks before the arithmetic operation that overflows. By verifying that the input values will not cause an overflow before performing the calculation, the vulnerable code path is eliminated. The fix was applied across all affected platforms in their respective December 2021 security updates.
Frequently Asked Questions
What is CVE-2021-30952?
CVE-2021-30952 is an integer overflow vulnerability in Apple's WebKit engine that can lead to arbitrary code execution when processing maliciously crafted web content. The integer overflow causes an incorrect buffer size calculation, which results in a heap buffer overflow that an attacker can exploit to execute code within the browser or application process.
Which Apple products are affected?
The vulnerability affects tvOS before 15.2, macOS Monterey before 12.1, Safari before 15.2, iOS before 15.2, iPadOS before 15.2, and watchOS before 8.3. This means nearly every Apple device type is affected, including iPhones, iPads, Macs, Apple TVs, and Apple Watches.
How do I fix CVE-2021-30952?
Update all Apple devices to the patched versions: tvOS 15.2+, macOS Monterey 12.1+, Safari 15.2+, iOS 15.2+, iPadOS 15.2+, and watchOS 8.3+. Enable automatic updates to ensure timely installation of future security patches. Organizations should use MDM to enforce minimum OS versions across managed devices.
How does CVE-2021-30952 differ from other WebKit vulnerabilities?
While many WebKit vulnerabilities involve use-after-free or type confusion, CVE-2021-30952 is an integer overflow that leads to a heap buffer overflow. The exploitation technique differs because the attacker must trigger a specific arithmetic overflow to control the size of a buffer allocation. The local attack vector (CVSS AV:L) and lower base score (7.8 vs. 8.8 for some network-vector WebKit flaws) reflect the slightly different exploitation requirements, though the ultimate impact of arbitrary code execution is the same.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.