What is the CVSS score of CVE-2025-31279?

CVE-2025-31279 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of iOS are affected by CVE-2025-31279?

CVE-2025-31279 enables unauthenticated remote fingerprinting of Apple device users by exploiting a permissions bypass flaw, affecting macOS and iPadOS platforms across multiple versions.

How to fix or mitigate CVE-2025-31279?

Within 24 hours: Inventory all macOS and iPadOS devices in your environment and identify current OS versions. Within 7 days: Distribute security advisories to device owners and prioritize patching for macOS Ventura (update to 13.7.7 or later), macOS Sonoma (14.7.7 or later), macOS Sequoia (15.6 or later), and iPadOS (17.7.9 or later). Within 30 days: Complete OS patching across all affected Apple devices and verify patch compliance through MDM or asset management tools.

iOS CVE-2025-31279

CRITICAL

Information Exposure (CWE-200)

2025-07-30 product-security@apple.com

Apple iOS macOS Information Disclosure Ipados

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Jul 30, 2025 - 00:15 nvd

CRITICAL 9.8

DescriptionCVE.org

A permissions issue was addressed with additional restrictions. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to fingerprint the user.

AnalysisAI

Applications on Apple operating systems can fingerprint users through a permissions flaw that bypasses privacy restrictions. Affects macOS Ventura 13.x, Sonoma 14.x, Sequoia 15.x, and iPadOS 17.x with patches released in versions 13.7.7, 14.7.7, 15.6, and 17.7.9 respectively. CVSS 9.8 critical severity contradicts the low EPSS score (0.07%, 22nd percentile) and information disclosure nature, suggesting scoring misalignment. No public exploit identified at time of analysis, but the low technical barrier (network accessible, no authentication required per CVSS vector) makes this concerning for privacy-focused environments despite the limited impact scope of user fingerprinting.

Technical ContextAI

This vulnerability stems from CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) in Apple's operating system permission framework. The flaw allows applications to bypass intended restrictions on accessing system information that can uniquely identify users through device fingerprinting techniques. Fingerprinting typically involves collecting hardware identifiers, system configuration details, installed applications, or behavioral patterns that create a unique profile. The affected CPE strings confirm impact across Apple's desktop and tablet OS families: macOS Ventura (13.x branch), macOS Sonoma (14.x), macOS Sequoia (15.x), and iPadOS 17.x. Apple's fix involved implementing additional restrictions in the permissions subsystem to prevent unauthorized information access, suggesting the original permission checks were either incomplete or incorrectly enforced, allowing sandboxed applications to escape their intended privacy boundaries.

RemediationAI

Apple has released vendor-confirmed patches addressing this permissions issue across all affected platforms. Users should upgrade to iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, or macOS Ventura 13.7.7 depending on their platform version. Official security advisories are available at https://support.apple.com/en-us/124148 (Sequoia), https://support.apple.com/en-us/124149 (Sonoma), https://support.apple.com/en-us/124150 (Ventura), and https://support.apple.com/en-us/124151 (iPadOS). No workarounds are documented; patching is the sole remediation path. Organizations should prioritize these updates for devices in privacy-sensitive roles or those handling regulated data, though the low EPSS score suggests this can follow normal patch cycles rather than emergency deployment.