Log in Start free

Actively exploited · Published Jul 29, 2025 · Assigned by apple

CVE-2025-31277

High 8.8 Exploited

In plain English

A high-severity memory corruption in iOS and iPadOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on March 20, 2026). The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.7%top 23.0% of all CVEs
Exploited in the wildYesCISA KEV since Mar 20, 2026
Attack tooling1Public PoC

CISA guidance

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Apr 3, 2026.

Official description

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8webkit2gtk32.50.0-1.el8_10ALSA-2025:17802
AlmaLinux:8webkit2gtk3-devel2.50.0-1.el8_10ALSA-2025:17802
AlmaLinux:8webkit2gtk3-jsc2.50.0-1.el8_10ALSA-2025:17802
AlmaLinux:8webkit2gtk3-jsc-devel2.50.0-1.el8_10ALSA-2025:17802
Debian:12webkit2gtk2.50.1-1~deb12u1DEBIAN-CVE-2025-31277
Debian:13webkit2gtk2.50.1-1~deb13u1DEBIAN-CVE-2025-31277
Debian:14webkit2gtk2.50.0-1DEBIAN-CVE-2025-31277
Debian:12wpewebkitno fix listedDEBIAN-CVE-2025-31277
Debian:13wpewebkitno fix listedDEBIAN-CVE-2025-31277
Debian:14wpewebkit2.50.0-1DEBIAN-CVE-2025-31277
Ubuntu:22.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2025-31277
Ubuntu:24.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2025-31277
Ubuntu:22.04:LTSwebkit2gtk2.50.1-0ubuntu0.22.04.1UBUNTU-CVE-2025-31277
Ubuntu:24.04:LTSwebkit2gtk2.50.1-0ubuntu0.24.04.1UBUNTU-CVE-2025-31277
Ubuntu:25.10webkit2gtk2.50.0-2ubuntu1UBUNTU-CVE-2025-31277
Ubuntu:22.04:LTSwpewebkitno fix listedUBUNTU-CVE-2025-31277

Affected products (as reported)

VendorProductVersions
Apple Safari 0 – before 18.6
Apple iOS and iPadOS 0 – before 18.6
Apple macOS 0 – before 15.6
Apple tvOS 0 – before 18.6
Apple visionOS 0 – before 2.6
Apple watchOS 0 – before 11.6

Weakness: CWE-119, CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References