CVE-2025-31277
Apple Multiple Products Buffer Overflow Vulnerability
Description
CVE-2025-31277 is a HIGH buffer overflow vulnerability affecting Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS, carrying a CVSS 3.1 score of 8.8. An improper restriction of operations within memory buffer bounds in WebKit allows processing of maliciously crafted web content to lead to memory corruption. Affected versions include Safari < 18.6, iPadOS < 18.6, iOS < 18.6, macOS 15.x < 15.6, tvOS < 18.6, visionOS < 2.6, and watchOS < 11.6. This CVE was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-03-20 with a remediation deadline of 2026-04-03. With an EPSS score of 0.00267 (50.1st percentile), this vulnerability sits at the median for exploitation probability but carries elevated risk due to its network-accessible attack vector and confirmed active exploitation. No ransomware association has been confirmed.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| apple | safari | < 18.6 |
| apple | ipados | < 18.6 |
| apple | iphone os | < 18.6 |
| apple | macos | >= 15.0, < 15.6 |
| apple | tvos | < 18.6 |
| apple | visionos | < 2.6 |
| apple | watchos | < 11.6 |
| webkitgtk | webkitgtk | < 2.50.0 |
| wpewebkit | wpe webkit | < 2.50.0 |
| redhat | enterprise linux | 6.0; 7.0; 8.0; 9.0 |
| redhat | enterprise linux aus | 8.2; 8.4; 8.6 |
| redhat | enterprise linux els | 7.0 |
| redhat | enterprise linux eus | 8.4; 8.6; 9.4 |
| redhat | enterprise linux tus | 8.6; 8.8 |
| redhat | enterprise linux update services for sap solutions | 8.6; 8.8; 9.0; 9.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/124147(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/124149(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/124152(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/124153(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/124154(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/124155(Release Notes, Vendor Advisory)
- http://seclists.org/fulldisclosure/2025/Aug/0(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Jul/30(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Jul/32(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Jul/36(Mailing List, Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2025:17643(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2025:17741(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2025:17743(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2025:17802(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2025:17807(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2025:18097(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2025:19109(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2025:19157(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2025:19165(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2025:19352(Third Party Advisory)
- https://access.redhat.com/security/cve/CVE-2025-31277(Third Party Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=2448780(Third Party Advisory)
- https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/(Technical Description)
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-31277.json(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31277(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2025-31277 is classified under CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer. This parent weakness class encompasses buffer overflows, out-of-bounds reads, and out-of-bounds writes. It occurs when software performs operations on a memory buffer without properly ensuring that the read or write operations stay within the buffer's intended boundaries.
In the context of WebKit — Apple's browser engine powering Safari and all iOS browsers — this weakness is critically dangerous. WebKit processes complex, untrusted web content including HTML, CSS, JavaScript, and multimedia formats. Memory buffer handling errors in WebKit can be triggered remotely by simply visiting a malicious webpage, making this vulnerability class one of the most exploited in the browser security landscape. The combination of a large attack surface (any web content), complex parsing logic, and performance-critical memory management creates persistent opportunities for buffer boundary violations that enable arbitrary code execution.
Impact Analysis
CVE-2025-31277 carries a CVSS 3.1 score of 8.8 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation through malicious web content allows the attacker to read sensitive data from the browser process memory. This can include authentication cookies, session tokens, saved passwords, browsing history, and data from other open tabs processed by the WebKit engine.
Integrity (HIGH): Memory corruption in WebKit enables the attacker to execute arbitrary code within the browser's context. This can be leveraged to modify web page content, intercept form submissions, redirect traffic, or install malware by escaping the browser sandbox.
Availability (HIGH): The memory corruption can crash the browser or the entire device. WebKit vulnerabilities can also be weaponized to cause persistent denial of service through repeated crashes when visiting attacker-controlled content.
Scope Unchanged: The vulnerability's scope is Unchanged (S:U), meaning the impact is initially contained within the WebKit rendering process. However, browser memory corruption vulnerabilities are frequently chained with sandbox escape exploits to achieve full device compromise.
The network attack vector (AV:N) significantly increases the risk profile compared to local vulnerabilities, as exploitation requires no physical access — only that the victim visits a malicious or compromised website.
Exploit Maturity
CVE-2025-31277 has confirmed active exploitation in the wild, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog on 2026-03-20.
Exploit status: Active exploitation has been confirmed. WebKit vulnerabilities with network-accessible attack vectors are prime targets for both state-sponsored actors and cybercriminal groups. The ability to trigger exploitation through web content makes this particularly dangerous for watering hole attacks and targeted phishing campaigns.
EPSS assessment: The EPSS score of 0.00267 (50.1st percentile) places this vulnerability at the median for exploitation probability. However, the confirmed KEV listing and network attack vector indicate the real-world risk is significantly higher than the statistical score suggests. WebKit zero-days are among the most valuable and actively traded vulnerabilities in the exploit marketplace.
Ransomware association: No direct ransomware association has been confirmed for CVE-2025-31277. However, browser-based memory corruption vulnerabilities are commonly used as initial access vectors in sophisticated attack chains. The network attack vector and lack of required authentication make this a viable entry point for broader compromise campaigns.
Attack surface: The vulnerability affects WebKit across Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. On iOS and iPadOS, all browsers are required to use WebKit as their rendering engine, meaning Chrome, Firefox, and all other iOS browsers are equally affected. This makes the attack surface effectively every Apple device with web browsing capability.
KEV deadline: CISA requires federal agencies to remediate this vulnerability by 2026-04-03. Given the network-accessible attack vector, organizations should prioritize this CVE for immediate remediation.
Remediation
- Apply Apple security updates immediately. Update all affected software to the patched versions: Safari 18.6, iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6. Consult Apple's official security advisory at support.apple.com/en-us/100100 for specific patch guidance.
- Inventory all Apple devices and browsers in your environment. Identify all instances of Safari and WebKit-based browsers across your organization. On iOS and iPadOS, remember that all browsers use WebKit — so Chrome, Firefox, Edge, and other browsers on Apple mobile devices are equally affected and require the OS-level update.
- Implement web content filtering as interim mitigation. If immediate patching is not feasible, deploy web content filtering and URL reputation services to block access to known malicious domains. Consider restricting JavaScript execution on untrusted sites and enabling enhanced tracking protection features.
- Monitor for exploitation indicators. Review browser crash logs, endpoint detection alerts, and web proxy logs for signs of exploitation. Look for unexpected WebKit process crashes, suspicious JavaScript execution patterns, or indicators of sandbox escape attempts following browser crashes.
- Educate users about phishing and malicious web content. Since exploitation requires visiting malicious web content, reinforce security awareness training about the risks of clicking unknown links, especially in email and messaging applications. Encourage users to report suspicious websites and unexpected browser crashes.
Technical Details
CVE-2025-31277 is a HIGH-severity buffer overflow vulnerability in Apple's WebKit browser engine caused by improper restriction of operations within memory buffer bounds. Processing maliciously crafted web content can lead to memory corruption with potential for arbitrary code execution.
Technical mechanism: The vulnerability exists in WebKit's memory handling routines during the processing of web content. When WebKit parses and renders HTML, CSS, JavaScript, or multimedia content, it allocates memory buffers for intermediate data structures. The improper restriction of operations within these buffer bounds means that specially crafted web content can trigger read or write operations that exceed the allocated buffer boundaries. This memory corruption can overwrite critical data structures including vtable pointers, heap metadata, or stack return addresses, enabling control flow hijacking and arbitrary code execution.
CVSS 3.1 vector breakdown (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H):
- Attack Vector (Network): The vulnerability is exploitable remotely through network-delivered web content. An attacker only needs to serve malicious content from a web server or inject it into a legitimate website. No local access to the target device is required.
- Attack Complexity (Low): The buffer overflow is reliably triggerable through crafted web content without requiring special network conditions, timing, or victim-specific preparation.
- Privileges Required (None): No authentication or special privileges are needed. Any anonymous attacker can host malicious web content.
- User Interaction (Required): The victim must navigate to the attacker's web content, typically by clicking a link in an email, message, or social media post, or by visiting a compromised legitimate website.
- Scope (Unchanged): The impact is initially contained within the WebKit rendering process. However, WebKit exploits are frequently chained with sandbox escapes for full device compromise.
- Impact (C:H/I:H/A:H): Full confidentiality, integrity, and availability compromise is possible. The attacker can read process memory, execute arbitrary code, and crash the application or device.
WebKit attack surface considerations: On Apple platforms, WebKit is the mandatory rendering engine for all browsers on iOS and iPadOS. This means the vulnerability affects not just Safari but every browser installed on these platforms. The rendering of web content in email clients, social media apps, and any application using WKWebView is also potentially affected, creating an exceptionally broad attack surface.
Frequently Asked Questions
What is CVE-2025-31277?
CVE-2025-31277 is a HIGH-severity buffer overflow vulnerability (CVSS 8.8) in Apple's WebKit browser engine affecting Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The vulnerability allows maliciously crafted web content to trigger memory corruption, potentially enabling arbitrary code execution. It is listed in CISA's KEV catalog, confirming active exploitation in the wild.
Which Apple products are affected by CVE-2025-31277?
Affected products include Safari < 18.6, iOS < 18.6, iPadOS < 18.6, macOS Sequoia 15.x < 15.6, tvOS < 18.6, visionOS < 2.6, and watchOS < 11.6. Critically, on iOS and iPadOS, all browsers are required to use WebKit as their rendering engine — so Chrome, Firefox, and all other iOS browsers are equally vulnerable and require the OS-level update to be fixed.
How do I fix CVE-2025-31277?
Update all affected Apple devices and software to the patched versions: Safari 18.6, iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6. On iOS and iPadOS, updating the operating system patches WebKit for all installed browsers. If immediate patching is not possible, implement web content filtering to block known malicious domains.
Why is CVE-2025-31277 more dangerous than the other Apple CVEs from the same date?
CVE-2025-31277 carries the highest CVSS score (8.8) among the three because it has a Network attack vector (AV:N) rather than Local (AV:L). This means exploitation requires no physical access or malicious application installation — a victim only needs to visit a malicious webpage. The combination of remote exploitability, no required privileges, and full CIA impact makes WebKit vulnerabilities among the most dangerous in the Apple ecosystem.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.