CVE-2025-31201
Apple Multiple Products Arbitrary Read and Write Vulnerability
Description
CVE-2025-31201 is a critical vulnerability in multiple Apple products that allows an attacker with arbitrary read and write capabilities to bypass Pointer Authentication (PAC), a hardware-level security feature designed to protect against code reuse attacks. Apple has acknowledged that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS. The vulnerability affects macOS Sequoia (before 15.4.1), iOS and iPadOS (before 18.4.1), tvOS (before 18.4.1), and visionOS (before 2.4.1). With a CVSS v3.1 score of 9.8 (CRITICAL) and its inclusion in CISA's Known Exploited Vulnerabilities catalog, CVE-2025-31201 represents a serious threat particularly relevant to high-value targets and individuals at risk of targeted surveillance.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| apple | macos | >= 15.0, < 15.4.1 |
| apple | tvos | < 18.4.1 |
| apple | visionos | < 2.4.1 |
| apple | ipados | < 18.4.1 |
| apple | iphone os | < 18.4.1 |
References
- https://support.apple.com/en-us/122282(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122400(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122401(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/122402(Release Notes, Vendor Advisory)
- http://seclists.org/fulldisclosure/2025/Apr/26(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Jun/14(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Oct/0(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Oct/3(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Oct/4(Mailing List, Third Party Advisory)
- https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201/blob/main/Remote%20Crypto%20Attack%20Chain%20.md(Broken Link, Exploit)
- https://github.com/cisagov/vulnrichment/issues/200(Issue Tracking)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31201(US Government Resource)
Weakness Type
CWE-1220: Insufficient Granularity of Access Control
CVE-2025-31201 is classified under CWE-1220 (Insufficient Granularity of Access Control), which describes a condition where access control mechanisms do not provide sufficiently fine-grained restrictions. In this case, the vulnerability allows an attacker who has already achieved arbitrary read and write access to memory to bypass Apple's Pointer Authentication Code (PAC) security mechanism, which is designed to prevent exactly this type of exploitation progression. The insufficient granularity in the PAC implementation allowed attackers to forge valid pointer authentication codes, defeating this critical defense layer.
Learn more: CWE-1220 — Insufficient Granularity of Access Control
Impact Analysis
CVE-2025-31201 carries a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating maximum exploitability and impact. The vulnerability is remotely exploitable (AV:N) with low complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N). Confidentiality (High): Bypassing PAC allows the attacker to execute arbitrary code on the device, granting access to all user data including messages, photos, credentials, location history, and encrypted communications. Integrity (High): The attacker can modify device behavior, install persistent surveillance implants, and alter or delete data without the user's knowledge. Availability (High): Full device compromise enables the attacker to render the device inoperable or use it as a surveillance tool. Apple's acknowledgment that this was used in "an extremely sophisticated attack against specific targeted individuals" suggests state-level or commercial spyware involvement. The EPSS score of 5.68% at the 90.23rd percentile indicates significant exploitation probability, though the targeted nature suggests this is not a mass exploitation vulnerability.
Exploit Maturity
CVE-2025-31201 has confirmed real-world exploitation. Apple explicitly stated this vulnerability "may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS," indicating targeted exploitation by advanced threat actors. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 8, 2025. Public exploit analysis is available through a detailed write-up of the iOS attack chain combining CVE-2025-31200 and CVE-2025-31201. CVE-2025-31201 is typically chained with CVE-2025-31200 (a memory corruption vulnerability in audio stream processing) to form a complete remote attack chain: CVE-2025-31200 provides the initial arbitrary read/write primitive, and CVE-2025-31201 is then used to bypass PAC protection to achieve reliable code execution. The EPSS score of 5.7% at the 90.2th percentile indicates a significant probability of exploitation.
Remediation
-
Update all Apple devices immediately. Install macOS Sequoia 15.4.1, iOS 18.4.1, iPadOS 18.4.1, tvOS 18.4.1, and visionOS 2.4.1 from the Apple security updates at support.apple.com. Apple addressed this vulnerability by removing the vulnerable code entirely.
-
Prioritize updates for high-risk individuals. Executives, journalists, activists, government officials, and anyone who may be a target of sophisticated surveillance should update immediately. Enable Lockdown Mode on iOS/macOS for additional hardening against targeted attacks.
-
Enable automatic updates. Configure all Apple devices in the organization to receive and install security updates automatically to minimize the window of exposure for future zero-day vulnerabilities.
-
Monitor for indicators of compromise. Use mobile device management (MDM) solutions to verify all devices are running patched firmware versions. For high-risk users, consider professional device forensic analysis to check for signs of spyware or exploitation artifacts.
-
Review device security posture. Ensure all Apple devices have Lockdown Mode available and enable it for users at elevated risk. Review installed profiles, device management configurations, and app permissions for any unauthorized changes that could indicate compromise.
Technical Details
CVE-2025-31201 is a Pointer Authentication bypass vulnerability affecting multiple Apple operating systems. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the severity when this vulnerability is exploited as part of a remote attack chain.
Pointer Authentication Codes (PAC) are an ARM architecture security feature used by Apple's A12 and later chips to cryptographically sign pointers, making it significantly harder for attackers to hijack control flow even when they have memory corruption primitives. CVE-2025-31201 allows an attacker who has already achieved arbitrary read and write access to memory to bypass this PAC protection. The vulnerability was addressed by Apple by removing the vulnerable code path entirely, suggesting a fundamental design issue in how certain pointer authentication checks were implemented rather than a simple input validation error. When chained with CVE-2025-31200 (a memory corruption in audio stream processing), the attacker can achieve full remote code execution: the audio processing vulnerability provides the initial memory corruption and read/write primitive, and CVE-2025-31201 then defeats PAC to redirect execution to attacker-controlled code. This chain was used in real-world targeted attacks against specific individuals on iOS.
Frequently Asked Questions
Is CVE-2025-31201 being actively exploited?
Yes. Apple has confirmed that CVE-2025-31201 was exploited in "an extremely sophisticated attack against specific targeted individuals on iOS." CISA has also added it to the Known Exploited Vulnerabilities catalog.
What products are affected by CVE-2025-31201?
Apple macOS Sequoia (before 15.4.1), iOS and iPadOS (before 18.4.1), tvOS (before 18.4.1), and visionOS (before 2.4.1) are affected. All Apple devices running these operating system versions should be updated.
How do I fix CVE-2025-31201?
Update to macOS Sequoia 15.4.1, iOS 18.4.1, iPadOS 18.4.1, tvOS 18.4.1, or visionOS 2.4.1. For high-risk users, also enable Apple's Lockdown Mode for additional protection against sophisticated attacks.
How severe is CVE-2025-31201?
With a CVSS v3.1 score of 9.8 (CRITICAL), CVE-2025-31201 is extremely severe. When combined with CVE-2025-31200, it enables full remote device compromise. The confirmed use in targeted attacks against individuals highlights the real-world danger of this vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.