CVE-2021-30900: Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

CVE-2021-30900 is an out-of-bounds write vulnerability in Apple GPU drivers that ship with iOS, iPadOS, and macOS. A malicious application can trigger the flaw and potentially execute code with kernel privileges, giving an attacker high-level control of the device. This matters for IT and security teams because kernel-level access can bypass many user-space controls, enable persistence, and support further compromise of managed Apple fleets.

Public detail is limited to the CISA summary and the stated CWE classes; confirm exact impact, affected builds, and exploitation status against the vendor advisory before acting.

How it works

The vulnerability combines improper input validation (CWE-20) with an out-of-bounds write (CWE-787) inside Apple GPU drivers. In this class of flaw, the driver fails to correctly bound-check data supplied by an application before writing it into memory. An attacker who can run a malicious application on the device can craft input that causes the driver to write outside the intended buffer. Because the GPU drivers operate with elevated privileges, a successful write can corrupt kernel memory structures and allow arbitrary code execution in the kernel context.

No public exploit mechanics beyond this high-level description are provided in the available facts. Defenders should treat any untrusted application that can reach the GPU interface as a potential trigger and should not assume user-space sandboxing alone is sufficient protection. Confirm the precise trigger conditions and any required privileges against the vendor advisory.

Am I affected? How to find it in your systems

The affected components are the GPU drivers included in Apple iOS, iPadOS, and macOS. These platforms are commonly found on corporate and personal iPhones, iPads, and Macs managed by MDM or endpoint tools. Inventory every Apple device in your environment—mobile, tablet, and desktop—and record the exact OS version and build currently installed.

• Use MDM, Apple Business Manager, or endpoint inventory agents to list all enrolled iOS, iPadOS, and macOS devices and their OS versions.
• Cross-check those versions against the vendor advisory for CVE-2021-30900 to determine which builds contain the vulnerable GPU drivers.
• Review application inventories for any non-App-Store or sideloaded software that could interact with graphics or GPU interfaces; such applications are the most likely delivery vehicle for a malicious payload.
• Examine device logs and EDR telemetry for unexpected kernel panics, GPU-related crashes, or anomalous process activity that elevates privileges shortly after an application launch. These signs are not unique to this CVE but can indicate exploitation of kernel-level write flaws.

If inventory data is incomplete, treat all unpatched Apple devices as potentially affected until confirmed otherwise.

How to remediate

The primary remediation is to apply the updates released by Apple according to the vendor instructions. CISA’s required action is simply to apply those updates. Once the vendor patch is installed, the out-of-bounds write condition in the GPU drivers is corrected.

• Prioritize devices that process sensitive data or that allow installation of third-party applications.
• Use MDM or automated update policies to push the fixed OS builds and verify successful installation via inventory reports.
• After patching, re-baseline device configurations and re-enable any temporary restrictions that were put in place while the vulnerability was open.
• For this class of kernel driver flaw, also review and harden application-install policies so that only trusted, signed software can reach the GPU interface.

Confirm the exact update names and build numbers against the vendor advisory; do not rely on third-party version lists.

If you can't patch immediately

When immediate patching is not possible, reduce the attack surface and increase detection until the vendor update can be applied.

• Segment Apple devices that cannot yet be updated onto restricted network segments with limited access to sensitive resources.
• Enforce strict application allow-listing or MDM restrictions that prevent installation of untrusted applications, thereby blocking the most common delivery path for a malicious app.
• If a web application firewall or endpoint virtual-patching capability is available, apply rules that limit anomalous GPU or graphics-related system calls; treat these as temporary compensating controls only.
• Increase monitoring for privilege-escalation indicators, unexpected kernel module loads, and GPU driver crashes; alert on any process that attempts to interact with the GPU after an untrusted application starts.
• Disable or restrict features that allow sideloading or developer-mode installation where operationally feasible.

These measures lower likelihood and impact but do not eliminate the vulnerability; schedule the official update as soon as possible.

If your data may have been exposed

Actively exploited kernel-privilege vulnerabilities can lead to full device compromise and subsequent data exposure. Known ransomware use of this specific CVE is not documented, yet any successful kernel-level code execution can still result in credential theft, lateral movement, or data exfiltration. If you suspect devices were compromised before patching, isolate them, collect forensic images, and rotate credentials that may have been present on the devices. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether any associated accounts appear in public breach corpora.