Actively exploited in the wild
Apple Multiple Products Memory Corruption Vulnerability
Apple - Multiple Products · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-30807
HighCVSS 7.8KEVSummary
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
Risk Assessment
The risk is that a malicious application can gain full control over the system, potentially leading to data theft, malware installation, or complete device compromise.
Recommendation
It is recommended to immediately update macOS, iOS, iPadOS, and watchOS to the latest versions containing fixes. Also avoid installing apps from untrusted sources.
Other vulnerabilities in Apple macOS/iOS/iPadOS/watchOS
See all- CVE-2020-27932HighActively exploited
A type confusion issue was addressed with improved state handling. The issue affects multiple Apple operating systems: macOS, watchOS, iOS, and iPadOS. A malicious application may be able to execute arbitrary code with kernel privileges.
- CVE-2020-27930HighActively exploited
A memory corruption issue was addressed with improved input validation. The issue affects multiple Apple operating systems: macOS, watchOS, iOS, and iPadOS. Processing a maliciously crafted font may lead to arbitrary code execution.
Original NVD description (English source)
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.