CVE-2021-30869 Apple iOS, iPadOS, and macOS Type Confusion

What is CVE-2021-30869?

CVE-2021-30869 is a high-severity memory corruption vulnerability in Apple Ipados, published on 24 Aug 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, Security Update 2021-006 Catalina. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of reports that an exploit for this issue exists in the wild.

Weakness: CWE-843

Which versions are affected by CVE-2021-30869?

It affects 4 products.

Products include Apple Ipados, Apple Iphone Os, Apple Mac Os X, Apple Macos.

How do I fix CVE-2021-30869?

No fix has been published for CVE-2021-30869 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Nov 2021.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-30869 being exploited?

Yes. Attackers have exploited CVE-2021-30869 in the wild since at least 3 Nov 2021.

Other vulnerabilities in Apple Ipados

• CVE-2025-43300 Apple iOS, iPadOS, and macOS Out-of-Bounds Write Exploited Critical 10.0
• CVE-2025-24201 Apple Multiple Products WebKit Out-of-Bounds Write Exploited Critical 10.0
• CVE-2025-24085 Apple Multiple Products Use-After-Free Exploited Critical 10.0
• CVE-2025-31200 Apple Multiple Products Memory Corruption Exploited Critical 9.8
• CVE-2025-31201 Apple Multiple Products Arbitrary Read and Write Exploited Critical 9.8

All Apple Ipados vulnerabilities

Sources

• CVE record
• NVD
• OSV
• How this page is made