BLACKOUT MAP

Apple · iOS, iPadOS, and macOS

CVE-2021-30900

Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Exploited in attacks High 7.8 Attack chance: 5.2%
Share

What it is

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1, iOS 15.1 and iPadOS 15.1. A malicious application may be able to execute arbitrary code with kernel privileges.

CISA: Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: April 20, 2023

Added to the CISA list
March 30, 2023
Published
August 24, 2021
Severity
High 7.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS)
5.2% in the top 7.6% of all known vulnerabilities
Weakness
CWE-20 CWE-787
More details
NVD · CVE.org · CISA
All references (3)

More exploited flaws from Apple

AddedVulnerabilityProductSeverityAttack chance
Aug 21, 2025Out-of-Bounds WriteCVE-2025-43300iOS, iPadOS, and macOSCritical 10.065%
Sep 11, 2023ImageIO Buffer OverflowCVE-2023-41064iOS, iPadOS, and macOSHigh 7.853%
Apr 10, 2023IOSurfaceAccelerator Out-of-Bounds WriteCVE-2023-28206iOS, iPadOS, and macOSHigh 8.623%
Sep 14, 2022Remote Code ExecutionCVE-2022-32917iOS, iPadOS, and macOSHigh 7.85.6%
Sep 8, 2022Input ValidationCVE-2020-9934iOS, iPadOS, and macOSMedium 5.53.2%
Feb 11, 2022Webkit Use-After-FreeCVE-2022-22620iOS, iPadOS, and macOSHigh 8.816%
Nov 3, 2021WebKit Remote Code ExecutionCVE-2021-1870iOS, iPadOS, and macOSCritical 9.87.7%
Nov 3, 2021WebKit Remote Code ExecutionCVE-2021-1871iOS, iPadOS, and macOSCritical 9.87.0%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.