CVE-2025-31277

Published Jul 30, 2025

Last updated 2 days ago

Exploit known CVSS high 8.8

Overview

Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, watchOS 11.6, visionOS 2.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6. Processing maliciously crafted web content may lead to memory corruption.
Source: product-security@apple.com
NVD status: Analyzed
Products: safari, ipados, iphone_os, macos, tvos, visionos, watchos

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Apple Multiple Products Buffer Overflow Vulnerability
Exploit added on: Mar 20, 2026
Exploit action due: Apr 3, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-119

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 3

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "969AD7A8-5CCF-4607-BBE8-E06E642A170C",
            "versionEndExcluding": "18.6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "8ED4015E-C707-4A91-86B3-23100E0DFA8F",
            "versionEndExcluding": "18.6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "BD9D42A7-DE2A-4D5A-8C7B-002A60148483",
            "versionEndExcluding": "18.6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "4CF17CE2-DB4B-48D1-81AF-67EF1EC7BB45",
            "versionEndExcluding": "15.6",
            "versionStartIncluding": "15.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "FBC1698A-3E9C-4055-B23A-13A3C22BD6EE",
            "versionEndExcluding": "18.6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "EADBC0BD-ECAC-4E0A-B490-24649AFE5355",
            "versionEndExcluding": "2.6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "35D9C2D7-6120-4631-8D0B-259641DFD85B",
            "versionEndExcluding": "11.6",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.