Security readout for executives and security teams
Plain-English summary
This is an Apple iOS web-content flaw where a malicious webpage could make a vulnerable device run attacker-controlled code. Apple fixed it in iOS 12.5.4 and reported awareness of possible active exploitation. The business risk is highest for legacy iOS devices that remain below the fixed release.
Executive priority
Treat this as a high-priority legacy-device remediation item, not a theoretical bug. The vulnerability enables code execution through malicious web content, has high impact, and appears in CISA KEV. Organizations should quickly find and update or retire exposed iOS 12-era devices.
Technical view
CVE-2021-30762 is a CWE-416 use-after-free issue in iOS web content processing. The CVSS 3.1 vector is 8.8 high: network reachable, low complexity, no privileges, user interaction required, with high confidentiality, integrity, and availability impact. Apple says improved memory management addressed the issue in iOS 12.5.4.
Likely exposure
Exposure is most likely on Apple iOS devices covered by the iOS 12.5.4 security update but not updated. The provided sources do not enumerate every affected model or exact vulnerable version range beyond Apple iOS and the fixed iOS 12.5.4 release.
Exploitation context
Active exploitation is supported by two signals: Apple stated it was aware of a report that the issue may have been actively exploited, and CISA lists CVE-2021-30762 in the Known Exploited Vulnerabilities catalog. Sources do not provide exploit volume, targets, or campaign details.
Researcher notes
The source evidence is concise: use-after-free, web content processing, arbitrary code execution, fixed via improved memory management in iOS 12.5.4. User interaction is required by the CVSS vector. No public exploit mechanics, indicators, or vulnerable build list are included in the provided sources.
Mitigation direction
- Update affected iOS devices to iOS 12.5.4 or later where applicable.
- Check Apple advisory HT212548 for device-specific guidance and replacement constraints.
- Prioritize legacy devices used by executives, administrators, and mobile workers.
- Retire or isolate devices that cannot receive the fixed iOS update.
- Use MDM reporting to enforce minimum iOS version compliance.
Validation and detection
- Confirm each managed iOS device reports iOS 12.5.4 or a later applicable release.
- Identify unmanaged legacy Apple devices through asset inventory and procurement records.
- Review MDM compliance exceptions for devices below the fixed release.
- Check whether vulnerable devices still access corporate email, VPN, or privileged apps.
- Track remediation against CISA KEV obligations where they apply.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-30762 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/HT212548CVE reference · x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30762CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.