by Kastro
Paper/Archive/CVE-2025-31201

CVE-2025-31201

Apple iOS and iPadOS — Apple Multiple Products Arbitrary Read and Write Vulnerability

KEV · due 8 MayEPSS 14%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 96.5.965 × 2019.3Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.

Affected

ProductAffectedFixed inSource
iOS and iPadOS< 18.4.118.4.1CNA
macOS< 15.4.115.4.1CNA
tvOS< 18.4.118.4.1CNA
visionOS< 2.4.12.4.1CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refsupport.apple.com/en-us/122282refsupport.apple.com/en-us/122400refsupport.apple.com/en-us/122401refsupport.apple.com/en-us/122402refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31201writeupgithub.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201/blob/main/Remote%20Crypto%20Attack%20Chain%20.mdrefgithub.com/cisagov/vulnrichment/issues/200refseclists.org/fulldisclosure/2025/Oct/4refseclists.org/fulldisclosure/2025/Oct/3refseclists.org/fulldisclosure/2025/Oct/0refseclists.org/fulldisclosure/2025/Jun/14refseclists.org/fulldisclosure/2025/Apr/26kevcisa.gov/known-exploited-vulnerabilities-catalog