What is the CVSS score of CVE-2025-31278?

CVE-2025-31278 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of iOS are affected by CVE-2025-31278?

CVE-2025-31278 is a high-severity memory corruption vulnerability in Apple's WebKit engine affecting Safari, iOS, iPadOS, and macOS that allows attackers to execute arbitrary code on user devices…. A patch is available.

How to fix or mitigate CVE-2025-31278?

Within 24 hours: Identify all Apple devices running Safari 18.x, iOS/iPadOS 18.x, or macOS Sequoia 15.x in your environment and notify device owners of critical updates. Within 7 days: Deploy Apple security updates (Safari 18.x patch, iOS/iPadOS 18.x patch, macOS Sequoia 15.x patch) via your MDM solution; confirm 95%+ compliance. Within 30 days: Audit and document patch deployment across all Apple devices; implement endpoint detection and response (EDR) monitoring for unusual process execution originating from Safari; consider implementing web content filtering to block known malicious sites.

iOS CVE-2025-31278

HIGH

Buffer Overflow (CWE-119)

2025-07-30 product-security@apple.com

Memory Corruption Apple iOS macOS Red Hat Ipados Iphone Os Safari Tvos Visionos Watchos Suse

8.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 05, 2026 - 20:30 nvd

Patch available

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Jul 30, 2025 - 00:15 nvd

HIGH 8.8

DescriptionNVD

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

AnalysisAI

Memory corruption in Apple's WebKit browser engine across Safari 18.x, iOS/iPadOS 18.x, macOS Sequoia 15.x, and other Apple operating systems allows remote attackers to achieve arbitrary code execution via maliciously crafted web content requiring only user interaction (visiting a malicious webpage). With CVSS 8.8 (High), the vulnerability enables complete system compromise (high confidentiality, integrity, and availability impact) but carries relatively low real-world exploitation probability (EPSS 0.10%, 27th percentile). No public exploit identified at time of analysis, and vendor-released patches are available across all affected platforms as of July-August 2025.

Technical ContextAI

This vulnerability affects WebKit, Apple's open-source browser engine that powers Safari and in-app web views across the entire Apple ecosystem. The CWE-119 classification indicates an improper restriction on operations within memory buffer bounds, commonly manifesting as buffer overflows or out-of-bounds writes. WebKit's complex memory management for rendering HTML, CSS, and JavaScript makes it a frequent target for memory safety issues. The CPE strings confirm impact spans Safari browser (desktop), iOS/iPadOS mobile devices, macOS desktop systems, tvOS (Apple TV), visionOS (Vision Pro headset), and watchOS (Apple Watch), indicating the vulnerability exists in shared WebKit components used universally across Apple's product line. The 'improved memory handling' fix description suggests the vendor addressed unsafe memory operations in content parsing or rendering code paths, likely involving heap or stack buffer management during processing of attacker-controlled web resources.

RemediationAI

Apply vendor-released patches immediately: upgrade Safari to version 18.6 or later, iOS and iPadOS to version 18.6 or later (legacy iPadOS users should upgrade to 17.7.9), macOS Sequoia to version 15.6 or later, tvOS to 18.6 or later, visionOS to 2.6 or later, and watchOS to 11.6 or later. Patches are available through standard Apple Software Update mechanisms on all platforms, with detailed installation instructions in Apple's security advisories at https://support.apple.com/en-us/124147 through 124155. Organizations managing Apple device fleets should prioritize MDM-based patch deployment to user-facing systems and mobile devices. Debian-based Linux systems using WebKit should follow guidance at https://lists.debian.org/debian-lts-announce/2025/08/msg00015.html for appropriate package updates. No effective workarounds exist beyond disabling web browsing entirely, which is impractical for most use cases. Given the network attack vector and potential for drive-by exploitation, patching should take precedence over mitigation controls. For environments unable to immediately patch, consider restricting web access to known-trusted domains via content filtering and deploying browser isolation technologies to contain potential exploitation until updates can be applied.