Reference page — cumulative record through Wednesday, October 7, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2021-1871

CVE-2021-1871CRITICAL

Apple iOS, iPadOS, and macOS

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0700   94.0   YES

AFFECTED
  Product         Versions       Fixed
  iOS and iPadOS  unspecified –  —
  macOS           unspecified –  —

TIMELINE
  Dec 8   Reserved by apple
  Apr 2   Published (CNA: apple)
  Nov 3   Added to CISA KEV, remediation due 2021-11-17

CNA: apple · CVSS v3.1 · 5 references · KEV due November 17, 2021

Description

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
December 8, 2020	Reserved	Reserved by apple
April 2, 2021	Published	Published (CNA: apple)
November 3, 2021	KEV ADDED	Added to CISA KEV, remediation due 2021-11-17

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Apple	iOS and iPadOS	—	unspecified	—
Apple	macOS	—	unspecified	—

References (5)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU/ [vendor-advisory, x_refsource_FEDORA]
https://support.apple.com/en-us/HT212146 [x_refsource_MISC]
https://support.apple.com/en-us/HT212147 [x_refsource_MISC]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1871 [government-resource]
https://www.debian.org/security/2021/dsa-4923 [vendor-advisory, x_refsource_DEBIAN]

Authoritative record: CVE-2021-1871 at cve.org

Vendors: apple

About this page