CVE-2021-36976: Apple iPadOS

Medium severity, CVSS 6.5. EPSS: 2.8% chance of exploitation in the next 30 days.

libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).

Affected products

• Apple iPadOS: before 15.4 (fixed in 15.4)
• Apple iPhone OS: before 15.4 (fixed in 15.4)
• Apple macOS: before 12.3 (fixed in 12.3)
• Apple watchOS: before 8.5 (fixed in 8.5)
• Fedoraproject Fedora: version 35 only
• Libarchive Libarchive: from 3.4.1, up to and including 3.5.2
• Splunk Universal Forwarder: from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 9.0.0, before 9.0.6 (fixed in 9.0.6); version 9.1.0 only

Published 2021-07-20. Last modified 2026-06-17.