CVE-2021-1789

KEVApple Multiple Products Type Confusion Vulnerability

Description

A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.

A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

PublishedApr 2, 2021

Last modifiedJun 17, 2026

Added to KEVMay 4, 2022

Remediation dueMay 25, 2022

References

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ/Broken LinkMailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/Broken LinkMailing List
security.gentoo.org/glsa/202104-03Third Party Advisory
support.apple.com/en-us/HT212146Release NotesVendor Advisory
support.apple.com/en-us/HT212147Release NotesVendor Advisory
support.apple.com/en-us/HT212148Release NotesVendor Advisory
support.apple.com/en-us/HT212149Release NotesVendor Advisory
support.apple.com/en-us/HT212152Release NotesVendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1789US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1617 days
CVSS: 8.8 HIGH
EPSS (30-day exploit probability): 14.0% · top 3% of all CVEs
Weakness: CWE-843
Attack vector: Network, remotely reachable

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.