All vulnerabilities
CVE-2025-31277

Apple Multiple Products Buffer Overflow Vulnerability

Apple Multiple Products
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationExploited in the wildAdded to KEV 20 Mar 2026CISA KEV
Exploit odds (EPSS)1.66%Chance of exploitation activity in the next 30 days, higher than 76% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in18.6Also 15.6, 2.6 and 1 moreCVE List
Federal deadline3 Apr 2026Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 29 Jul 2025, 23:29 UTCPublishedCVE List
  2. 20 Mar 2026Added to CISA KEVCISA KEV

Description

Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.

Text from CVE List

Affected versions 6

  • Safariaffected: all versions before 18.6CVE List
  • iOS and iPadOSaffected: all versions before 18.6CVE List
  • macOSaffected: all versions before 15.6CVE List
  • tvOSaffected: all versions before 18.6CVE List
  • visionOSaffected: all versions before 2.6CVE List
  • watchOSaffected: all versions before 11.6CVE List

References 22