Paper/Archive/CVE-2025-31255

CVE-2025-31255

Apple iOS and iPadOS — An authorization issue was addressed with improved state management.

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 76.2.762 × 2015.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, watchOS 26. An app may be able to access sensitive user data.

Affected

ProductAffectedFixed inSource

iOS and iPadOS< 2626CNA

macOS< 14.814.8CNA

macOS< 15.715.7CNA

macOS< 2626CNA

tvOS< 2626CNA

watchOS< 2626CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsupport.apple.com/en-us/125108 refsupport.apple.com/en-us/125110 refsupport.apple.com/en-us/125111 refsupport.apple.com/en-us/125112 refsupport.apple.com/en-us/125114 refsupport.apple.com/en-us/125116 refseclists.org/fulldisclosure/2025/Sep/57 refseclists.org/fulldisclosure/2025/Sep/55 refseclists.org/fulldisclosure/2025/Sep/54 refseclists.org/fulldisclosure/2025/Sep/53 refseclists.org/fulldisclosure/2025/Sep/49