What’s Vulnerable › Vulnerabilities
CVE-2021-1870: Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2021-11-03
- EPSS: 7.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-04-02 · updated 2026-06-17
Description
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
Affected products
- Apple iPadOS: before 14.4 — fixed in 14.4
- Apple Iphone Os: before 14.4 — fixed in 14.4
- macOS: from 10.15 before 10.15.7; 10.15.7, 10.15.7-security_update_2020-001, 10.15.7-supplemental_update — fixed in 10.15.7
- Apple macOS: from 11.0.1 before 11.2 — fixed in 11.2
- Fedoraproject Fedora: 32, 33
- Webkit: before 2.30.6 — fixed in 2.30.6
How to fix
Upgrade to a fixed version: Apple iPadOS 14.4; Apple Iphone Os 14.4; macOS 10.15.7; Apple macOS 11.2; Webkit 2.30.6. Check the vendor advisory for mitigations.
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/
- https://security.gentoo.org/glsa/202104-03
- https://support.apple.com/en-us/HT212146
- https://support.apple.com/en-us/HT212147
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/
- https://security.gentoo.org/glsa/202104-03
- https://support.apple.com/en-us/HT212146
- https://support.apple.com/en-us/HT212147
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1870
Get alerted when CVE-2021-1870 or the next vulnerability affects your stack