CVE-2021-30952
published 2021-08-24CVE-2021-30952: An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2…
PriorityP184high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2026-03-26
Exploited in the wild
EPSS
7.62%
93.9th percentile
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_and_ipados | >= unspecified < 15.2 | 15.2 |
| apple | ipados | < 15.2 | 15.2 |
| apple | iphone_os | < 15.2 | 15.2 |
| apple | macos | >= 12.0 < 12.1 | 12.1 |
| apple | macos | >= unspecified < 12.1 | 12.1 |
| apple | macos | >= unspecified < 15.2 | 15.2 |
| apple | macos_monterey | — | — |
| apple | safari | < 15.2 | 15.2 |
| apple | safari | — | — |
| apple | tvos | < 15.2 | 15.2 |
| apple | tvos | — | — |
| apple | watchos | < 8.3 | 8.3 |
| apple | watchos | — | — |
| apple | watchos | >= unspecified < 8.3 | 8.3 |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | webkit2gtk | < webkit2gtk 2.34.4-1 (bookworm) | webkit2gtk 2.34.4-1 (bookworm) |
| debian | wpewebkit | < webkit2gtk 2.34.4-1 (bookworm) | webkit2gtk 2.34.4-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| webkitgtk | webkitgtk | < 2.34.4 | 2.34.4 |
| wpewebkit | wpe_webkit | < 2.34.4 | 2.34.4 |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
0xf00dbeef
- →The Coruna exploit kit bails out if the device is in Lockdown Mode or the user is in private browsing — absence of exploit activity on Lockdown Mode devices can be used as a behavioral differentiator. ↗
- →Binary payloads are served from URLs ending with .min.js — network detection should flag .min.js URLs delivering binary/encrypted blobs (non-JavaScript content) from suspicious domains. ↗
- →Binary payloads are encrypted with ChaCha20 and packaged in a custom format with magic header 0xf00dbeef — scan network captures or disk for files beginning with this 4-byte magic. ↗
- →The exploit kit is delivered via a hidden iFrame injected into compromised websites — monitor for hidden cross-origin iFrame injections on iOS user-agent traffic. ↗
- →The JavaScript framework uses XOR-based string/integer obfuscation constructs — detect patterns like `.map(x => {return String.fromCharCode(x ^ <constant>);}).join("")` in JavaScript delivered to iOS clients. ↗
- →CVE-2021-30952 is exploited by the 'buffout' module targeting iOS 13 through 15.1.1; devices not yet patched to iOS 15.2 remain vulnerable to this WebContent R/W primitive. ↗
- →The x-ts header is a network-level indicator associated with the Coruna framework — inspect HTTP headers for 'x-ts' in requests from iOS devices to suspicious domains. ↗
- ·CVE associations in the exploit chain table are preliminary and subject to revision as analysis is ongoing. ↗
- ·All identified websites and domains have been added to Google Safe Browsing, reducing but not eliminating risk from the listed infrastructure. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vulncheck7.8HIGH
cisa7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2021-30952: An integer overflow was addressed with improved input validation
osv·2021-08-24·CVSS 7.8
CVE-2021-30952 [HIGH] CVE-2021-30952: An integer overflow was addressed with improved input validation
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.
VulnCheck
Apple Multiple Products Integer Overflow or Wraparound Vulnerability
vulncheck·2021·CVSS 7.8
CVE-2021-30952 [HIGH] CWE-190 Apple Multiple Products Integer Overflow or Wraparound Vulnerability
Apple Multiple Products Integer Overflow or Wraparound Vulnerability
Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.
Affected: Apple Multiple Products
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2026-03-26
CISA
Apple Multiple Products Integer Overflow or Wraparound Vulnerability
cisa·2026-03-05·CVSS 7.8
CVE-2021-30952 [HIGH] CWE-190 Apple Multiple Products Integer Overflow or Wraparound Vulnerability
Vulnerability: Apple Multiple Products Integer Overflow or Wraparound Vulnerability
Affected: Apple Multiple Products
Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://support.apple.com/en-us/HT212975 ; https://support.apple.com/en-us/HT212976 ; https://support.apple.com/en-us/HT212978 ; https://support.apple.com/en-us/HT212980 ; https://support.apple.com/en-us/HT212982 ; https://nvd.nist.gov/vuln/detail/CVE-2021-30952
Remediation Due Date: 2
Ubuntu
WebKitGTK vulnerabilities
vendor_ubuntu·2022-01-27
CVE-2021-30936 WebKitGTK vulnerabilities
Title: WebKitGTK vulnerabilities
Summary: Several security issues were fixed in WebKitGTK.
A large number of security issues were discovered in the WebKitGTK Web and
JavaScript engines. If a user were tricked into viewing a malicious
website, a remote attacker could exploit a variety of issues related to web
browser security, including cross-site scripting attacks, denial of service
attacks, and arbitrary code execution.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK, such as Epiphany, to make all the necessary changes.
Red Hat
webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution
vendor_redhat·2022-01-21·CVSS 7.8
CVE-2021-30952 [HIGH] CWE-190 webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution
webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.
A flaw was found in webkitgtk. The vulnerability occurs due to improper input validation, which can lead to an integer overflow. An attacker with network access could pass specially crafted web content files causing an application to halt, crash, or may lead to arbitrary code execution.
Package: webkitgtk (Red Hat Enterprise Linux 6) - Out of support scope
Package: webkitgtk3 (Red Hat Enterprise Linux 7) - Out of support scope
Package: webkit2gtk
Apple
CVE-2021-30952: Safari 15.2
vendor_apple·2021-12-14·CVSS 7.8
CVE-2021-30952 [HIGH] CVE-2021-30952: Safari 15.2
Apple Security Update: About the security content of Safari 15.2
Product: Safari
Version: 15.2
CVE: CVE-2021-30952
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input validation.
Apple
CVE-2021-30952: watchOS 8.3
vendor_apple·2021-12-13·CVSS 7.8
CVE-2021-30952 [HIGH] CVE-2021-30952: watchOS 8.3
Apple Security Update: About the security content of watchOS 8.3
Product: watchOS
Version: 8.3
CVE: CVE-2021-30952
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input validation.
Apple
CVE-2021-30952: macOS Monterey 12.1
vendor_apple·2021-12-13·CVSS 7.8
CVE-2021-30952 [HIGH] CVE-2021-30952: macOS Monterey 12.1
Apple Security Update: About the security content of macOS Monterey 12.1
Product: macOS Monterey
Version: 12.1
CVE: CVE-2021-30952
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input validation.
Apple
CVE-2021-30952: tvOS 15.2
vendor_apple·2021-12-13·CVSS 7.8
CVE-2021-30952 [HIGH] CVE-2021-30952: tvOS 15.2
Apple Security Update: About the security content of tvOS 15.2
Product: tvOS
Version: 15.2
CVE: CVE-2021-30952
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input validation.
Debian
CVE-2021-30952: webkit2gtk - An integer overflow was addressed with improved input validation. This issue is ...
vendor_debian·2021·CVSS 7.8
CVE-2021-30952 [HIGH] CVE-2021-30952: webkit2gtk - An integer overflow was addressed with improved input validation. This issue is ...
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.
Scope: local
bookworm: resolved (fixed in 2.34.4-1)
bullseye: resolved (fixed in 2.34.4-1~deb11u1)
forky: resolved (fixed in 2.34.4-1)
sid: resolved (fixed in 2.34.4-1)
trixie: resolved (fixed in 2.34.4-1)
No detection rules found.
No public exploits indexed.
Mandiant
Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit
blogs_mandiant·2026-03-03
Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit
Threat Intelligence
# Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit
March 3, 2026
##### Google Threat Intelligence Group
##### Google Threat Intelligence
Visibility and context on the threats that matter most.
Contact Us & Get a Demo
### Introduction
Google Threat Intelligence Group (GTIG) has identified a new and powerful exploit kit targeting Apple iPhone models running iOS version 13.0 (released in September 2019) up to version 17.2.1 (released in December 2023). The exploit kit, named “Coruna” by its developers, contained five full iOS exploit chains and a total of 23 exploits. The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits, with the most advanced ones using non-public exploitation techniques and mitigation bypas
Mandiant
Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit
blogs_mandiant·2026-03-03
Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit
## Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit
## Google Threat Intelligence Group
## Google Threat Intelligence
Visibility and context on the threats that matter most.
## Introduction
Google Threat Intelligence Group (GTIG) has identified a new and powerful exploit kit targeting Apple iPhone models running iOS version 13.0 (released in September 2019) up to version 17.2.1 (released in December 2023) . The exploit kit, named “Coruna” by its developers, contained five full iOS exploit chains and a total of 23 exploits. The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits, with the most advanced ones using non-public exploitation techniques and mitigation bypasses.
The Coruna exploit kit provides another example of how sophi
http://www.openwall.com/lists/oss-security/2022/01/21/2https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EQVZ3CEMTINLBZ7PBC7WRXVEVCRHNSM/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQKWD4BXRDD2YGR5AVU7H5J5PIQIEU6V/https://support.apple.com/en-us/HT212975https://support.apple.com/en-us/HT212976https://support.apple.com/en-us/HT212978https://support.apple.com/en-us/HT212980https://support.apple.com/en-us/HT212982https://www.debian.org/security/2022/dsa-5060https://www.debian.org/security/2022/dsa-5061http://www.openwall.com/lists/oss-security/2022/01/21/2https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EQVZ3CEMTINLBZ7PBC7WRXVEVCRHNSM/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQKWD4BXRDD2YGR5AVU7H5J5PIQIEU6V/https://support.apple.com/en-us/HT212975https://support.apple.com/en-us/HT212976https://support.apple.com/en-us/HT212978https://support.apple.com/en-us/HT212980https://support.apple.com/en-us/HT212982https://www.debian.org/security/2022/dsa-5060https://www.debian.org/security/2022/dsa-5061https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kithttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30952
2021-08-24
Published
2026-03-05
Added to CISA KEV
Exploited in the wild