CVE-2021-1788

What it actually does

Use-after-free condition in memory management that occurs while processing maliciously crafted web content, enabling arbitrary code execution.

Why it matters to the business

Remote code execution risk on affected devices and downstream dependents, with slight EPSS increase and named threat actor interest; old vulnerability still requires attention for ecosystem packages like pysaml2 and ndpi.

How an attack unfolds

Attacker crafts malicious web content that triggers the use-after-free during rendering in WebKit; listed actors such as Candiru have leveraged similar Apple WebKit flaws for targeted execution.

How to fix it

Update to macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4, iPadOS 14.4, Safari 14.0.3 or apply the pysaml2 commit e60755e23a4efdbc13e1317128d1dcfa4a9cab9e and ndpi commit b7e666e465f138ae48ab81976726e67deed12701 where applicable.

How to confirm the fix worked

Confirm devices and packages are at the listed fixed versions or commits; retest web content processing paths for the use-after-free condition.

Typical attack path

1. Deliver malicious web content via browser or app
2. Trigger use-after-free through crafted HTML/JS
3. Achieve arbitrary code execution in process context
4. Escalate to full device compromise

How to detect it

Search browser and system logs for crashes during web content rendering; correlate with known threat actor patterns around Apple WebKit flaws.

What your security team should do

• Apply the specified Apple updates and Git commits immediately given the 2014-day exposure window
• Monitor for similar WebKit issues in downstream dependents
• Review threat actor reports mentioning Candiru or SOURGUM for related activity