CVE-2025-31277: Apple Multiple Products Buffer Overflow Vulnerability
Vulnerability summary
CVE-2025-31277 is a high (CVSS 8.8) vulnerability in Apple Multiple Products. It is known to be exploited: CISA lists it, first on 20-03-2026. EPSS estimates a 1.60% chance of exploitation in the next 30 days, higher than 75.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 15 · Related 5Timeline
- 29-07-2025PublishedVulnerability first disclosed.
- 20-03-2026Added to CISA KEVApple Multiple Products Buffer Overflow Vulnerability
- 03-04-2026CISA remediation dueApply mitigations per vendor instructions.
- 21-09-2026Last modifiedVulnerability information updated.
Description
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.60%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
+0.07 pp
From 1.53% on 18-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 20-03-2026
- Federal due date
- 03-04-2026
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. support.apple.com/en-us/124147 support.apple.com/en-us/124149 support.apple.com/en-us/124152 support.apple.com/en-us/124153 support.apple.com/en-us/124155 nvd.nist.gov/vuln/detail/CVE-2025-31277
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
Affected systems
Apple8 products
- ios and ipados< 18.6
- ipados< 18.6
- iphone_os< 18.6
- macos< 15.6 | ≥ 15.0, < 15.6
- safari< 18.6
Redhat6 products
- enterprise_linuxEOL6.0 | 7.0 | 8.0 | 9.0
- enterprise_linux_aus8.2 | 8.4 | 8.6
- enterprise_linux_els7.0
- enterprise_linux_eus8.4 | 8.6 | 9.4
- enterprise_linux_tus8.6 | 8.8
Ubuntu5 products
- qtwebkit-opensource-srcAll versions (No fix recorded)
- qtwebkit-sourceAll versions (No fix recorded)
- webkit2gtkAll versions (No fix recorded) | < 2.50.1-0ubuntu0.22.04.1 | < 2.50.1-0ubuntu0.24.04.1 | < 2.50.0-2ubuntu1
- webkitgtkAll versions (No fix recorded)
- wpewebkitAll versions (No fix recorded)
Debian2 products
- webkit2gtk< 2.50.1-1~deb12u1 | < 2.50.1-1~deb13u1 | < 2.50.0-1
- wpewebkitAll versions (No fix recorded) | < 2.50.0-1
Webkitgtk1 product
- webkitgtk< 2.50.0
Wpewebkit1 product
- wpe_webkit< 2.50.0
6 vendors · 23 products
References
30 links- cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/Third Party AdvisoryTechnical Description
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31277Government ResourceUS Government Resource
Show all 30 references
- security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-31277.jsonX Sadp Csaf VexThird Party Advisory
