Skip to main content

Watchos CVE-2025-31277

HIGH
Buffer Overflow (CWE-119)
2025-07-30 product-security@apple.com
Buffer Overflow Apple Ipados Iphone Os Tvos Visionos Watchos
8.8
CVSS 3.1 · Vendor: apple
View

Vulnerability Assessment

Weakness
CWE
CWE-119
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

High risk due to zero-click exploitation potential via web browsing. WebKit vulnerabilities affect all iOS browsers (Chrome, Firefox on iOS use WebKit) and are prime targets for commercial spyware vendors.
Exploit ScenarioDerived

An attacker sends a link via iMessage or email. When the victim opens it in any iOS browser, the crafted web content triggers WebKit memory corruption, allowing the attacker to execute code within the browser process and chain with a kernel exploit for full device compromise.
Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.
Exploited in the wild (CISA KEV) Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 19, 2026

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing maliciously crafted web content, exploited in the wild as a zero-day.

Earlier versions of this analysis (1)
v1 Mar 19, 2026 - 18:30 CVSS 8.8

A memory corruption vulnerability in WebKit affects Safari, watchOS, visionOS, iOS/iPadOS, macOS Sequoia, and tvOS. Processing specially crafted web content triggers memory corruption that can lead to arbitrary code execution.

RemediationAI

Update all Apple devices immediately. Organizations should enable Rapid Security Response on managed devices and consider Lockdown Mode for high-risk users.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The CWE-119 buffer handling flaw in WebKit's content processing engine allows an attacker to corrupt heap memory through malicious HTML/JavaScript payloads. Apple addressed this with improved memory handling in the WebKit rendering pipeline.

Know when Watchos gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Patch released
Apr 05, 2026 - 20:30 nvd
Patch available
Added to CISA KEV
Apr 03, 2026 - 14:30 cisa
CISA KEV
PoC Detected
Apr 03, 2026 - 14:30 vuln.today
Public exploit code
CVE Published
Jul 30, 2025 - 00:15 nvd
HIGH 8.8

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, watchOS 11.6, visionOS 2.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6. Processing maliciously crafted web content may lead to memory corruption.

Executive ViewAI

Why It Matters

Organizations using The face significant risk from CVE-2025-31277, a buffer overflow vulnerability rated CVSS 8.8. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

Threat Score
4.8/10
Composite threat intelligence
EPSS Score
0.1%
Top 68% exploitable
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
NVD CVE.org CISA KEV EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV Yes
Public POC Yes
EPSS 0.1%
Patch available Yes
Active threat Yes
Deciding rule
In CISA KEV with patch available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Immediate
Exploitation· derived
Active
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Very High

Priority Score

114
Low Medium High Critical
KEV: +50
EPSS: 0
CVSS: +44
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Affected Products (CPE)CVE.org

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

More in Watchos

View all
CVE-2022-2294 HIGH
8.8 Jul 28

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
CVE-2017-13861 HIGH POC
7.8 Dec 25

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2016-0801 CRITICAL POC
9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2016-4669 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2017-2370 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2025-24201 CRITICAL
10.0 Mar 11

A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
CVE-2014-8147 HIGH POC
7.5 May 25

The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in I
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2022-37434 CRITICAL POC
9.8 Aug 05

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-6558 HIGH
8.8

Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:17643 ADVISORY https://access.redhat.com/errata/RHSA-2025:17741 ADVISORY https://access.redhat.com/errata/RHSA-2025:17743 ADVISORY https://access.redhat.com/errata/RHSA-2025:17802 ADVISORY https://access.redhat.com/errata/RHSA-2025:17807 ADVISORY https://access.redhat.com/errata/RHSA-2025:18097 ADVISORY https://access.redhat.com/errata/RHSA-2025:19109 ADVISORY https://access.redhat.com/errata/RHSA-2025:19157 ADVISORY https://access.redhat.com/errata/RHSA-2025:19165 ADVISORY https://access.redhat.com/errata/RHSA-2025:19352 ADVISORY https://support.apple.com/en-us/124147 ADVISORY https://support.apple.com/en-us/124149 ADVISORY https://support.apple.com/en-us/124152 ADVISORY https://support.apple.com/en-us/124153 ADVISORY https://support.apple.com/en-us/124154 ADVISORY https://support.apple.com/en-us/124155 ADVISORY https://vuldb.com/?id.318156 ADVISORY https://vuldb.com/?id.318157 ADVISORY https://vuldb.com/?id.318158 ADVISORY https://vuldb.com/?id.318159 ADVISORY https://vuldb.com/?id.318160 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1139/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1150/ REF http://seclists.org/fulldisclosure/2025/Aug/0 REF http://seclists.org/fulldisclosure/2025/Jul/30 REF http://seclists.org/fulldisclosure/2025/Jul/32 REF http://seclists.org/fulldisclosure/2025/Jul/36 REF https://access.redhat.com/security/cve/CVE-2025-31277 REF https://bugzilla.redhat.com/show_bug.cgi?id=2448780 REF https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/ REF https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-31277.json REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31277

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy