CVE-2025-31200
Apple Multiple Products Memory Corruption Vulnerability
Description
CVE-2025-31200 is a critical memory corruption vulnerability in Apple's audio stream processing that can be triggered by a maliciously crafted media file, leading to arbitrary code execution. Apple has acknowledged that this vulnerability may have been exploited in "an extremely sophisticated attack against specific targeted individuals on iOS." The flaw affects macOS Sequoia (before 15.4.1), iOS and iPadOS (before 18.4.1), tvOS (before 18.4.1), visionOS (before 2.4.1), and watchOS (before 11.5). With a CVSS v3.1 score of 9.8 (CRITICAL), CVE-2025-31200 is the initial attack vector in a two-vulnerability chain (paired with CVE-2025-31201) that enables complete remote device compromise, making it an urgent priority for all Apple device users.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | macos | >= 15.0, < 15.4.1 |
| apple | tvos | < 18.4.1 |
| apple | visionos | < 2.4.1 |
| apple | ipados | < 18.4.1 |
| apple | iphone os | < 18.4.1 |
| apple | watchos | < 11.5 |
References
- https://support.apple.com/en-us/122282(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122400(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122401(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122402(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122722(Release Notes, Vendor Advisory)
- http://seclists.org/fulldisclosure/2025/Apr/26(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Jun/14(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/May/10(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Oct/0(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Oct/4(Mailing List, Third Party Advisory)
- https://blog.noahhw.dev/posts/cve-2025-31200/(Broken Link, Exploit)
- https://news.ycombinator.com/item?id=44161894(Issue Tracking)
- https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201/blob/main/Remote%20Crypto%20Attack%20Chain%20.md(Broken Link, Exploit)
- https://github.com/cisagov/vulnrichment/issues/200(Issue Tracking)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31200(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2025-31200 is primarily classified under CWE-787 (Out-of-bounds Write), which occurs when software writes data past the end or before the beginning of a buffer. In Apple's audio stream processing, a maliciously crafted media file can trigger a write operation that exceeds the allocated buffer boundaries, corrupting adjacent memory. This type of vulnerability is particularly dangerous as it can be exploited to gain arbitrary code execution by overwriting critical data structures or function pointers.
Learn more: CWE-787 — Out-of-bounds Write
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
The vulnerability is also classified under CWE-119 (Buffer Overflow), the parent category for memory boundary violations. The audio codec processing fails to properly validate or restrict memory operations when handling certain audio stream formats, resulting in memory corruption that enables attacker-controlled code execution.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2025-31200 has a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting maximum exploitability and impact. The vulnerability is remotely exploitable (AV:N) with low complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N) beyond the normal processing of a media file that could be delivered through messaging apps, email, websites, or other channels. Confidentiality (High): Code execution on an Apple device grants access to all stored data including messages, photos, contacts, location data, keychain credentials, and encrypted communications. Integrity (High): The attacker can install persistent implants, modify device behavior, intercept communications, and manipulate data without detection. Availability (High): Complete device control enables denial of service, data destruction, or conversion of the device into a surveillance tool. The confirmed exploitation in targeted attacks against specific individuals, combined with the wide range of affected products (iOS, macOS, tvOS, visionOS, watchOS), underscores the critical nature of this vulnerability. The EPSS score of 1.7% at the 82.2th percentile suggests exploitation is possible but not yet widespread.
Exploit Maturity
CVE-2025-31200 has confirmed real-world exploitation. Apple explicitly acknowledged that this vulnerability "may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS." CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 8, 2025. Public exploit analysis is available through a detailed write-up of the attack chain and a technical blog post. CVE-2025-31200 is the initial exploitation vector in a sophisticated two-step attack chain: this memory corruption vulnerability provides the attacker with arbitrary read/write primitives, which are then leveraged through CVE-2025-31201 to bypass Pointer Authentication (PAC) and achieve reliable code execution. The "extremely sophisticated" characterization from Apple suggests involvement of nation-state actors or commercial spyware vendors. The EPSS score of 1.7% at the 82.2th percentile suggests exploitation is possible but not yet widespread.
Remediation
-
Update all Apple devices immediately. Install macOS Sequoia 15.4.1, iOS 18.4.1, iPadOS 18.4.1, tvOS 18.4.1, visionOS 2.4.1, and watchOS 11.5. Apple addressed this vulnerability with improved bounds checking in audio stream processing. Official updates are available at support.apple.com.
-
Prioritize high-risk individuals. Journalists, human rights activists, government officials, executives, and anyone who may be a target of surveillance should update immediately and enable Apple's Lockdown Mode, which restricts attack surface by limiting certain features including media processing.
-
Implement organizational device management. Use MDM solutions to enforce minimum OS version requirements across all managed Apple devices. Create compliance policies that flag devices running vulnerable versions and restrict access to corporate resources until updated.
-
Exercise caution with media files. Until all devices are patched, treat media files from unknown or untrusted sources with heightened suspicion. Avoid opening media attachments or clicking media links from unexpected senders, particularly in messaging applications.
-
Conduct forensic assessment for at-risk users. For individuals who may have been targeted by sophisticated attackers, consider professional mobile forensic analysis using tools designed to detect spyware artifacts. Check for unusual battery drain, unexpected data usage, or other indicators of compromise.
Technical Details
CVE-2025-31200 is a memory corruption vulnerability in Apple's audio stream processing subsystem. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the full impact when exploited remotely.
The vulnerability exists in the audio codec processing logic used across Apple's operating systems. When processing an audio stream embedded in a maliciously crafted media file, the decoder fails to properly validate input parameters, leading to an out-of-bounds write (CWE-787) that corrupts adjacent heap or stack memory. The root cause is a buffer overflow condition (CWE-119) where the bounds checking in the audio processing path was insufficient to handle specially crafted audio stream data. Apple addressed the vulnerability with improved bounds checking, suggesting the fix adds proper validation of audio stream parameters before performing memory write operations. The vulnerability is particularly significant because audio processing typically occurs automatically when media files are previewed or played, often without explicit user action. In the documented attack chain, CVE-2025-31200 provides the initial memory corruption primitive, giving the attacker arbitrary read and write access to device memory, which is then leveraged through CVE-2025-31201 to bypass Pointer Authentication and execute arbitrary code with full device privileges.
Frequently Asked Questions
Is CVE-2025-31200 being actively exploited?
Yes. Apple has confirmed that CVE-2025-31200 was exploited in "an extremely sophisticated attack against specific targeted individuals on iOS." CISA has added it to the Known Exploited Vulnerabilities catalog, confirming active real-world exploitation.
What products are affected by CVE-2025-31200?
Apple macOS Sequoia (before 15.4.1), iOS and iPadOS (before 18.4.1), tvOS (before 18.4.1), visionOS (before 2.4.1), and watchOS (before 11.5) are all affected. The vulnerability exists in the shared audio processing code used across Apple's product line.
How do I fix CVE-2025-31200?
Update to macOS Sequoia 15.4.1, iOS 18.4.1, iPadOS 18.4.1, tvOS 18.4.1, visionOS 2.4.1, or watchOS 11.5. Enable Lockdown Mode on iOS and macOS for additional protection, especially if you may be a target of sophisticated attacks.
How severe is CVE-2025-31200?
With a CVSS v3.1 score of 9.8 (CRITICAL), CVE-2025-31200 is extremely severe. It enables remote code execution through a malicious media file and was confirmed as the entry point in a real-world targeted attack chain that achieved full device compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.