CVE-2021-30737, @xerub's 2021 iOS ASN.1 Vulnerability

Summary: Google Project Zero's Ian Beer analyzed CVE-2021-30737, a memory corruption bug in the ASN.1 decoder that Apple fixed in iOS 14.6 by removing vulnerable code, after @xerub tweeted about it on May 25, 2021. The flaw sits in sec_asn1d_parse_bit_string, part of the ASN.1 parser in Security.framework that is a fork of Mozilla's NSS parser, and Apple's release notes state that processing a maliciously crafted certificate may lead to arbitrary code execution.
What you should know: The bug lives in the certificate parser that handles accessory connections over the Lightning port - the same attack surface the Washington Post reported Azimuth exploited to unlock the San Bernardino iPhone - so a maliciously crafted certificate reaching that parser can mean arbitrary code execution on the device.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-30737
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026