EXPOSURES › CVE-2021-30663
CVE-2021-30663
HIGH ⌖ ON CISA KEV · EXPLOITEDWebKit integer overflow in Apple products allows remote code execution via malicious web content.
An integer overflow vulnerability in Apple's WebKit engine enables remote code execution when processing malicious web content, impacting iOS, iPadOS, macOS, tvOS, and Safari. DIB organizations must ensure all Apple devices and WebKit-dependent systems are patched promptly, as this flaw was actively exploited in the wild and represents a significant compliance risk under NIST 800-171 for unpatched vulnerabilities.
Shame score — A critical integer overflow flaw in a widely used rendering engine was actively exploited in the wild, demonstrating severe negligence in patching and vulnerability management.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
"This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing."
"Here is a compiled list of vulnerabilities that have been exploited (KEV) with their affected products."
"CISA's Known Exploited Vulnerabilities (KEV) catalog is the authoritative list of security flaws that have been confirmed exploited in real-world attacks."