EXPOSURES › CVE-2021-30666
CVE-2021-30666
HIGH ⌖ ON CISA KEV · EXPLOITEDApple iOS WebKit buffer overflow allows remote code execution via malicious web content.
A buffer overflow in Apple iOS WebKit enables attackers to execute arbitrary code when processing malicious web pages, impacting Safari and other WebKit-based browsers. DIB organizations must ensure all iOS devices and WebKit-dependent systems are patched promptly, as this vulnerability was actively exploited in the wild and represents a significant compliance risk under NIST 800-171 for unpatched software.
Shame score — A critical buffer overflow in a widely used browser engine was actively exploited in the wild, indicating a failure to patch a known vulnerability before it was weaponized.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Apple iOS WebKit contains a buffer-overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
"CISA's Known Exploited Vulnerabilities (KEV) catalog is the authoritative list of security flaws that have been confirmed exploited in real-world attacks."
"Here is a compiled list of vulnerabilities that have been exploited (KEV) with their affected products."
"This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing."