Skip to main content

Safari CVE-2025-31278

HIGH
Buffer Overflow (CWE-119)
2025-07-30 product-security@apple.com
Memory Corruption Apple iOS macOS Red Hat Ipados Iphone Os Safari Tvos Visionos Watchos Suse
8.8
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-119
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

The CVSS 8.8 severity reflects high theoretical impact with Network attack vector (AV:N), Low complexity (AC:L), and no privileges required (PR:N), but requires User Interaction (UI:R) as the attacker must convince the victim to visit a malicious webpage or open crafted content. However, the EPSS score of 0.10% (27th percentile) indicates very low predicted exploitation probability in the next 30 days, suggesting threat actors have not prioritized this vulnerability despite public disclosure. No public exploit code exists and no CISA KEV listing confirms active exploitation, placing this in the 'tracked but not urgent' category for most organizations. The SSVC framework assessment shows: exploitation status is publicly disclosed but proof-of-concept absent, automatable potential is low due to user interaction requirement, and technical impact is total system compromise. While the vulnerability enables complete device takeover if successfully exploited, the combination of required user interaction, absence of exploitation evidence, and available patches reduces immediate risk. Priority should focus on user-facing systems and mobile device fleets where patch deployment may lag, but this is not a drop-everything emergency compared to actively exploited vulnerabilities.
Exploit ScenarioDerived

An attacker crafts a malicious webpage containing specially formatted HTML, CSS, or JavaScript designed to trigger improper memory operations in WebKit's rendering engine, causing out-of-bounds writes to corrupt process memory. The attacker hosts this page on a compromised legitimate website or distributes links via phishing emails, SMS messages, or social media posts. When a victim using an unpatched Apple device visits the malicious page, the WebKit engine processes the crafted content, triggering the memory corruption vulnerability that overwrites critical memory structures with attacker-controlled data. Through careful memory manipulation techniques like heap spraying or ROP chain construction, the attacker achieves arbitrary code execution within the context of the Safari browser or the app hosting the WebKit view, potentially escalating to full device compromise by exploiting additional vulnerabilities or abusing existing permissions to steal credentials, access sensitive data, install persistent malware, or pivot to corporate networks if the device is enrolled in enterprise management.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 02, 2026

Memory corruption in Apple's WebKit browser engine across Safari 18.x, iOS/iPadOS 18.x, macOS Sequoia 15.x, and other Apple operating systems allows remote attackers to achieve arbitrary code execution via maliciously crafted web content requiring only user interaction (visiting a malicious webpage). With CVSS 8.8 (High), the vulnerability enables complete system compromise (high confidentiality, integrity, and availability impact) but carries relatively low real-world exploitation probability (EPSS 0.10%, 27th percentile). No public exploit identified at time of analysis, and vendor-released patches are available across all affected platforms as of July-August 2025.

RemediationAI

Apply vendor-released patches immediately: upgrade Safari to version 18.6 or later, iOS and iPadOS to version 18.6 or later (legacy iPadOS users should upgrade to 17.7.9), macOS Sequoia to version 15.6 or later, tvOS to 18.6 or later, visionOS to 2.6 or later, and watchOS to 11.6 or later. Patches are available through standard Apple Software Update mechanisms on all platforms, with detailed installation instructions in Apple's security advisories at https://support.apple.com/en-us/124147 through 124155. Organizations managing Apple device fleets should prioritize MDM-based patch deployment to user-facing systems and mobile devices. Debian-based Linux systems using WebKit should follow guidance at https://lists.debian.org/debian-lts-announce/2025/08/msg00015.html for appropriate package updates. No effective workarounds exist beyond disabling web browsing entirely, which is impractical for most use cases. Given the network attack vector and potential for drive-by exploitation, patching should take precedence over mitigation controls. For environments unable to immediately patch, consider restricting web access to known-trusted domains via content filtering and deploying browser isolation technologies to contain potential exploitation until updates can be applied.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability affects WebKit, Apple's open-source browser engine that powers Safari and in-app web views across the entire Apple ecosystem. The CWE-119 classification indicates an improper restriction on operations within memory buffer bounds, commonly manifesting as buffer overflows or out-of-bounds writes. WebKit's complex memory management for rendering HTML, CSS, and JavaScript makes it a frequent target for memory safety issues. The CPE strings confirm impact spans Safari browser (desktop), iOS/iPadOS mobile devices, macOS desktop systems, tvOS (Apple TV), visionOS (Vision Pro headset), and watchOS (Apple Watch), indicating the vulnerability exists in shared WebKit components used universally across Apple's product line. The 'improved memory handling' fix description suggests the vendor addressed unsafe memory operations in content parsing or rendering code paths, likely involving heap or stack buffer management during processing of attacker-controlled web resources.

Know when Safari gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch released
Apr 05, 2026 - 20:30 nvd
Patch available
CVE Published
Jul 30, 2025 - 00:15 nvd
HIGH 8.8

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

Executive ViewAI

Why It Matters

CVE-2025-31278 is a high-severity memory corruption vulnerability in Apple's WebKit engine affecting Safari, iOS, iPadOS, and macOS that allows attackers to execute arbitrary code on user devices through malicious web content. This vulnerability poses significant risk to organizational endpoints and BYOD devices, as exploitation requires only that users visit a compromised or attacker-controlled webpage, making it a credible attack vector against the workforce regardless of security awareness.

Business Impact: High
Compensating Controls

Vendor-released patch: Apply Safari 18.x security update, iOS/iPadOS 18.x security update, and macOS Sequoia 15.x security update from Apple. Until patching is complete, restrict Safari access to pre-approved domains via MDM policy, disable JavaScript execution where operationally feasible, and ensure real-time EDR monitoring is active on all affected devices to detect post-exploitation activity.

Threat Intelligence Overview

EPSS Score
0.1%
Top 73% exploitable
Data Quality
3 sources
Confidence: Low
NVD CVE.org EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Affected Products (CPE)CVE.org

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

More in Safari

View all
CVE-2017-2547 HIGH POC
8.8 May 22

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2014-1303 CRITICAL POC
10.0 Mar 26

Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox

CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
CVE-2015-1155 MEDIUM POC
4.3 May 08

The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allo
CVE-2015-1126 MEDIUM POC
4.3 Apr 10

WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not

CVE-2017-2446 HIGH POC
8.8 Apr 02

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13802 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13795 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13794 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13792 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13785 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13784 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Memory Corruption

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Enterprise Storage 7.1 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:13780 ADVISORY https://access.redhat.com/errata/RHSA-2025:13782 ADVISORY https://access.redhat.com/errata/RHSA-2025:14421 ADVISORY https://access.redhat.com/errata/RHSA-2025:14422 ADVISORY https://access.redhat.com/errata/RHSA-2025:14423 ADVISORY https://access.redhat.com/errata/RHSA-2025:14432 ADVISORY https://access.redhat.com/errata/RHSA-2025:14433 ADVISORY https://access.redhat.com/errata/RHSA-2025:14434 ADVISORY https://access.redhat.com/errata/RHSA-2025:14486 ADVISORY https://access.redhat.com/errata/RHSA-2025:15729 ADVISORY https://support.apple.com/en-us/124147 ADVISORY https://support.apple.com/en-us/124148 ADVISORY https://support.apple.com/en-us/124149 ADVISORY https://support.apple.com/en-us/124152 ADVISORY https://support.apple.com/en-us/124153 ADVISORY https://support.apple.com/en-us/124154 ADVISORY https://support.apple.com/en-us/124155 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02765/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02766/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02777/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02973/ REF http://seclists.org/fulldisclosure/2025/Aug/0 REF http://seclists.org/fulldisclosure/2025/Jul/31 REF http://seclists.org/fulldisclosure/2025/Jul/32 REF http://seclists.org/fulldisclosure/2025/Jul/36 REF http://www.openwall.com/lists/oss-security/2025/08/02/1 REF https://lists.debian.org/debian-lts-announce/2025/08/msg00015.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy