{"id":"CVE-2021-30883","published":"2021-08-24T19:15:16Z","modified":"2026-06-17T03:51:04Z","title":"Apple Multiple Products Memory Corruption Vulnerability","vendor":"Apple","product":"Multiple Products","tier":"core","eol":null,"description":{"text":"A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1, macOS Big Sur 11.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..","provenance":"source","from":"NVD"},"summary":{"text":"Apple's multiple products (including iOS, iPadOS, macOS, tvOS and watchOS) contain a memory corruption flaw, classified as an out-of-bounds write, in the kernel-level memory handling. A local attacker who can get a malicious application to run on the device and convince a user to open or interact with it can execute arbitrary code with kernel privileges, requiring no prior authentication.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:13:27Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.14721,"percentile":0.96664,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-05-23","dueDate":"2022-06-13","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-30883","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-10-11","exploitedFirstSeen":"2021-10-11","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2021-10-11"},{"url":"https://support.apple.com/en-us/103159","date":"2021-10-11"},{"url":"https://support.apple.com/en-us/103164","date":"2021-10-25"},{"url":"https://support.apple.com/en-us/103165","date":"2021-10-25"},{"url":"https://support.apple.com/en-us/103167","date":"2021-10-25"},{"url":"https://support.apple.com/en-us/103162","date":"2021-10-26"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-05-23"},{"url":"https://blog.google/threat-analysis-group/italian-spyware-vendor-targets-users-in-italy-and-kazakhstan/","date":"2022-06-23"},{"url":"https://resources.jamf.com/documents/technical-papers/Coldintro-Coldinvite-Mystery-v2.0.pdf","date":"2023-05-22"},{"url":"https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spying_-_Insights_into_Commercial_Surveillance_Vendors.pdf","date":"2024-02-06"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://support.apple.com/en-us/HT212846","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212868","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212869","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212872","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212874","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212876","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212846","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212868","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212869","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212872","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212874","tags":["Vendor Advisory"]},{"url":"https://support.apple.com/en-us/HT212876","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30883","tags":["US Government Resource"]}],"techniques":[{"id":"T1211","name":"Exploitation for Stealth","tactics":["stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: malicious app exploits kernel memory corruption flaw","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An application may be able to execute arbitrary code with kernel privileges","start":223,"end":298}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: kernel-level code execution escalates privileges","mappingType":"primary_impact","evidence":[{"from":"description","quote":"execute arbitrary code with kernel privileges","start":253,"end":298}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-17800","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-17800","exploited":true,"exploitedSince":"2022-05-23","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1211"],"provenance":"ai"},{"stage":"primary","techniques":["T1068"],"provenance":"ai"}],"timeline":[{"date":"2021-08-24","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30883","provenance":"source"},{"date":"2021-10-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2022-05-23","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-05-23","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-17800","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":272},"priority":{"score":62.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1844 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.33,"detail":"percentile 0.9666"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-apple-ios-macos-cwe-787"}}