Apple
CVE-2025-31201
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V8 - Authorization Insufficient granularity of access control
|
| Impact | Critical risk (CVSS 9.8). PAC bypass is one of the most valuable exploit primitives for Apple platforms. It neutralizes the hardware security feature that protects function pointers and return addresses from corruption. |
| Exploit ScenarioDerived | After achieving memory read/write through CVE-2025-31200, the attacker uses this PAC bypass to forge authenticated pointers, enabling arbitrary code execution despite hardware pointer signing. This completes the exploit chain for full device compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
Apple devices contain a vulnerability allowing attackers with arbitrary read/write to bypass Pointer Authentication Codes (PAC), addressed by removing the vulnerable code. Exploited alongside CVE-2025-31200.
Earlier versions of this analysis (1)
A vulnerability in Apple's RPAC (Return-oriented Programming Authenticated Code) implementation allows bypassing Pointer Authentication when an attacker has arbitrary read/write capability. Apple removed the vulnerable code entirely.
RemediationAI
Update all Apple devices immediately. Apple's approach of removing the vulnerable code indicates the feature was fundamentally flawed rather than simply missing a check.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-1220 insufficient granularity of access control in the PAC implementation allows bypassing the hardware-based code pointer integrity mechanism. This is a critical post-exploitation primitive that neutralizes Apple's primary defense against code reuse attacks.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 18.4.1, visionOS 2.4.1, iOS iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.
Executive ViewAI
Organizations using This face critical risk from CVE-2025-31201 rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB