CVE-2021-30900 is an out-of-bounds write vulnerability in Apple iOS, iPadOS, and macOS. CISA added it to the Known Exploited Vulnerabilities catalogue on 30 March 2023, which means attackers have used it in real attacks. Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.
What the vulnerability means
An out-of-bounds write is a memory corruption flaw, which means code can write past the space it was meant to use. In Apple GPU drivers, that kind of bug is especially serious because graphics and kernel-adjacent components sit close to trusted system boundaries.
For a glossary term page, the key point is that CVE-2021-30900 is not just a crash condition. It is a software weakness that can be turned into code execution, and the primary definition already establishes that it may allow a malicious application to execute code with kernel privileges.
Why this class of flaw is dangerous in Apple platform components
Out-of-bounds writes can corrupt adjacent memory, alter control data, or destabilise a privileged process. When the vulnerable component is part of iOS, iPadOS, or macOS, the consequence can move from application-level failure into system-level compromise.
Kernel privilege escalation matters because it can bypass normal sandboxing and access restrictions. That can turn a single malicious app, booby-trapped file, or chained exploit into broad device control, persistence, or deeper credential and data exposure.
How organisations should check exposure
The first question is whether your estate actually contains the affected Apple platforms and whether vulnerable versions are still present on managed or unmanaged devices. Inventory matters because a flaw like this is only actionable if the device fleet, user population, and update posture are known.
Use vendor advisories for version-specific remediation details and use the NIST National Vulnerability Database and the CVE Program for authoritative record context. If the vulnerability is in the CISA KEV catalogue, exposure should be treated as active rather than theoretical, and the Vulnerability Management Guide is useful for prioritising KEV-listed items in a remediation workflow.
Detection, remediation, and post-exploitation review
Where patching is possible, remediation should be treated as a priority because out-of-bounds write bugs are common candidates for chained exploitation. Where patching is delayed, compensating controls should focus on reducing attack surface, limiting untrusted app exposure, and tightening monitoring on affected endpoints.
After remediation, review for signs that the flaw may already have been used. The main concern is not just whether the device is now patched, but whether exploitation occurred before patching and left behind persistence, unusual process behaviour, or other post-compromise artefacts.
Risk and Threat Considerations
This vulnerability has a clear threat dimension because it was placed in CISA’s Known Exploited Vulnerabilities catalogue, which indicates real-world abuse. The core risk is that attacker-controlled code in a high-privilege graphics path can become a route to kernel execution and deeper device compromise.
Failure mechanism: An out-of-bounds write can corrupt memory in a privileged execution context, allowing an attacker to alter program flow or escalate privileges beyond the sandbox boundary.
Impact: Successful exploitation can enable code execution with kernel privileges, which may expose data, undermine device trust, and increase the blast radius of any chained compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE requires asset discovery, prioritisation, and remediation tracking. |
| Recommendation — Prioritise and remediate KEV-listed Apple devices through continuous vulnerability management. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | Active exploitation makes prioritisation and risk treatment central to this CVE. |
| Recommendation — Treat KEV-listed exploitation as a high-priority risk decision and accelerate remediation. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | This is a remediable software weakness requiring patch and exception handling. |
| RA-5 — Vulnerability Monitoring and Scanning | Exposure depends on identifying affected devices and validating remediation status. | |
| SI-16 — Memory Protection | Out-of-bounds writes are memory corruption issues that memory-protection controls are meant to constrain. | |
| Recommendation — Apply flaw remediation controls to patch affected Apple systems and track exceptions. Scan Apple endpoints for exposure and verify remediation status against vulnerability records. Use memory-protection controls to reduce exploitation paths from unsafe writes. | ||