Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2021-30761

HighExploitedPublic exploit

webkitgtk: Memory corruption leading to arbitrary code execution

Published Aug 15, 2022 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2021-30761, UBUNTU-CVE-2021-30761

Key Facts

Patch immediately
  • CVE-2021-30761 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Iphone OS (Apple), webkit2gtk (arch), wpewebkit (debian) and 22 more products.
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jun 14, 2021. Public exploit code is available.
  • EPSS estimates a 11% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Iphone OS 12.5.4, dleyna-renderer 0.6.0-3.el8, frei0r-plugins 1.6.1-7.el8.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

8.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

11%

Higher than 95.7% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2021-30761 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVNov 3, 2021Nov 17, 2021Not reported
Industry KEV feedJun 14, 2021Nov 17, 2021Not reported
CIRCL KEVNov 3, 2021Nov 17, 2021Not reported
ENISA EUVDNov 3, 2021n/aNot reported

Required action: Apply updates per vendor instructions.

Affected Products

395 affected entries in total
ProductAffected versionsFixed in
Iphone OSAppleSee advisory12.5.4
webkit2gtkarchSee advisory2.26.0-1
wpewebkitdebianSee advisory2.26.3-1
qtwebkit-opensource-srcubuntuSee advisoryn/a
qtwebkit-sourceubuntuSee advisoryn/a
20 more affected products in the full CVE brief

Patched Releases

Iphone OS

12.5.4

dleyna-renderer

0.6.0-3.el8

frei0r-plugins

1.6.1-7.el8

gnome-remote-desktop

0.1.8-3.el8

gnome-session

3.28.1-10.el8

gsettings-desktop-schemas

3.32.0-5.el8

gtk-doc

1.28-2.el8

gtk3

3.22.30-6.el8

gvfs

1.36.2-10.el8

iOS

12.5

libjavascriptcoregtk-4_0-18

2.34.3-2.82.1, 2.34.3-23.3, 2.34.3-3.92.1

libjavascriptcoregtk-4_0-18-32bit

2.34.3-23.3

LibRaw

0.19.5-2.el8

libsoup

2.62.3-2.el8

libwebkit2gtk-4_0-37

2.34.3-2.82.1, 2.34.3-23.3, 2.34.3-3.92.1

libwebkit2gtk-4_0-37-32bit

2.34.3-23.3

libwebkit2gtk3-lang

2.34.3-2.82.1, 2.34.3-23.3, 2.34.3-3.92.1

mutter

3.32.2-48.el8

nautilus

3.28.1-14.el8

PackageKit

1.1.12-6.el8, 1.1.12-6.el8.0.2

pipewire

0.3.6-1.el8

pipewire0.2

0.2.7-6.el8

potrace

1.15-3.el8

pygobject3

3.28.3-2.el8

tracker

2.1.5-2.el8

Timeline

  1. Added to Industry KEV feed

    Jun 14, 2021

  2. Added to CISA KEV

    Nov 3, 2021

  3. Added to CIRCL KEV

    Nov 3, 2021

  4. Added to ENISA EUVD

    Nov 3, 2021

  5. Publicly disclosed

    Aug 15, 2022

  6. Last updated

    Aug 4, 2026

Weakness Type

  • CWE-20 Improper Input Validation
  • CWE-787 Out-of-bounds Write

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2021-30761 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo