All vulnerabilities
CVE-2021-30869

Apple iOS, iPadOS, and macOS Type Confusion Vulnerability

Apple iOS, iPadOS, and macOSOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationExploited in the wildAdded to KEV 3 Nov 2021CISA KEV
Exploit odds (EPSS)4.13%Chance of exploitation activity in the next 30 days, higher than 90% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in14.4Also 11.2, 12.5 and 1 moreCVE List
Federal deadline17 Nov 2021Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 24 Aug 2021, 18:49 UTCPublishedCVE List
  2. 3 Nov 2021Added to CISA KEVCISA KEV

Description

Apple iOS, iPadOS, and macOS contain a type confusion vulnerability in the XNU which may allow a malicious application to execute code with kernel privileges.

Text from CVE List

Affected versions 4

  • iOS and iPadOSaffected: unspecified before 14.4CVE List
  • macOSaffected: unspecified before 11.2CVE List
  • macOSaffected: unspecified before 12.5CVE List
  • macOSaffected: unspecified before 2021CVE List

References 6