{"schemaVersion":3,"id":"CVE-2025-31201","aliases":[],"status":"published","duplicateOf":null,"title":"Apple Multiple Products Arbitrary Read and Write Vulnerability","description":"This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.","dates":{"published":"2025-04-16T18:24:31.230Z","modified":"2026-04-02T18:24:41.543Z","reserved":null,"kevAdded":["2025-04-17T00:00:00.000Z"],"kevDue":["2025-05-08T00:00:00.000Z"]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.13863,"percentile":0.96499,"severity":"medium","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.010000000000001674,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.13853},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.13853,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.13853,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.13853,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.13853,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.13853,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.13853,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.13853,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.13853,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.13853,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.13863,"percentile":0.96499}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.13853,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.13853,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.13853,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.13853,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.13973,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.13863,"percentile":0.96499}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2025-04-17T00:00:00.000Z","dueDate":"2025-05-08T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","name":"Apple Multiple Products Arbitrary Read and Write Vulnerability","description":"Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.","notes":[{"type":"url","href":"https://support.apple.com/en-us/122282","label":"support.apple.com/en-us/122282"},{"type":"url","href":"https://support.apple.com/en-us/122400","label":"support.apple.com/en-us/122400"},{"type":"url","href":"https://support.apple.com/en-us/122401","label":"support.apple.com/en-us/122401"},{"type":"url","href":"https://support.apple.com/en-us/122402","label":"support.apple.com/en-us/122402"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2025-31201","label":"nvd.nist.gov/vuln/detail/CVE-2025-31201"}],"vendor":"Apple","product":"Multiple Products","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2025-04-17T00:00:00.000Z","dueDate":"2025-05-08T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","name":"Apple Multiple Products Arbitrary Read and Write Vulnerability","description":"Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.","notes":[{"type":"url","href":"https://support.apple.com/en-us/122282","label":"support.apple.com/en-us/122282"},{"type":"url","href":"https://support.apple.com/en-us/122400","label":"support.apple.com/en-us/122400"},{"type":"url","href":"https://support.apple.com/en-us/122401","label":"support.apple.com/en-us/122401"},{"type":"url","href":"https://support.apple.com/en-us/122402","label":"support.apple.com/en-us/122402"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2025-31201","label":"nvd.nist.gov/vuln/detail/CVE-2025-31201"}],"vendor":"Apple","product":"Multiple Products","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_JGOYD_IOS-ATTACK-CHAIN-CVE-2025-31200-CVE-2025-31201","name":"Ios Attack Chain Cve 2025 31200 Cve 2025 31201","source":"github","url":"https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201/blob/main/Remote%20Crypto%20Attack%20Chain%20.md","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-1220","name":"Insufficient Granularity of Access Control","description":"The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1220.html"}],"affected":[{"vendor":"apple","product":"ios and ipados","name":"iOS and iPadOS","label":"ios and ipados","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 18.4.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.4.1","eol":null,"hubHref":"/vendor/apple/ios_and_ipados"},{"vendor":"apple","product":"ipados","name":"ipados","label":"ipados","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 18.4.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.4.1","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"ipados","label":"Apple iPadOS","category":"os"}},"hubHref":"/vendor/apple/ipados"},{"vendor":"apple","product":"iphone_os","name":"iphone os","label":"iphone_os","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 18.4.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.4.1","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"ios","label":"Apple iOS","category":"os"}},"hubHref":"/vendor/apple/iphone_os"},{"vendor":"apple","product":"macos","name":"macos","label":"macos","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 15.4.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 15.0, < 15.4.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 15.4.1 | ≥ 15.0, < 15.4.1","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"macos","label":"Apple macOS","category":"os"}},"hubHref":"/vendor/apple/macos"},{"vendor":"apple","product":"tvos","name":"tvos","label":"tvos","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 18.4.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.4.1","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"tvos","label":"Apple tvOS","category":"os"}},"hubHref":"/vendor/apple/tvos"},{"vendor":"apple","product":"visionos","name":"visionos","label":"visionos","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 2.4.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.1","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"visionos","label":"Apple visionOS","category":"os"}},"hubHref":"/vendor/apple/visionos"}],"affectedCount":6,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://support.apple.com/en-us/122282","label":"support.apple.com/en-us/122282","hostname":"support.apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/122400","label":"support.apple.com/en-us/122400","hostname":"support.apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/122401","label":"support.apple.com/en-us/122401","hostname":"support.apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/122402","label":"support.apple.com/en-us/122402","hostname":"support.apple.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31201","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31201","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]},{"url":"https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201/blob/main/Remote%20Crypto%20Attack%20Chain%20.md","label":"github.com/JGoyd/…","hostname":"github.com","tags":["Technical Description","Broken Link","Exploit"]},{"url":"https://github.com/cisagov/vulnrichment/issues/200","label":"github.com/cisagov/vulnrichment/issues/200","hostname":"github.com","tags":["Issue Tracking"]},{"url":"http://seclists.org/fulldisclosure/2025/Oct/4","label":"seclists.org/fulldisclosure/2025/Oct/4","hostname":"seclists.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Oct/3","label":"seclists.org/fulldisclosure/2025/Oct/3","hostname":"seclists.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Oct/0","label":"seclists.org/fulldisclosure/2025/Oct/0","hostname":"seclists.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Jun/14","label":"seclists.org/fulldisclosure/2025/Jun/14","hostname":"seclists.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2025/Apr/26","label":"seclists.org/fulldisclosure/2025/Apr/26","hostname":"seclists.org","tags":["Mailing List","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2025-04-16T18:24:31.230Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2025-04-17T00:00:00.000Z","label":"Added to CISA KEV","detail":"Apple Multiple Products Arbitrary Read and Write Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2025-05-08T00:00:00.000Z","label":"CISA remediation due","detail":"Apply mitigations per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2026-04-02T18:24:41.543Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T06:49:32.044Z","stale":false,"partial":false}}