What is the CVSS score of CVE-2025-31281?

CVE-2025-31281 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of iOS are affected by CVE-2025-31281?

CVE-2025-31281 is a critical memory handling vulnerability affecting Apple's entire ecosystem (iOS, iPadOS, macOS, tvOS, visionOS) that allows unauthenticated remote attackers to crash applications…

How to fix or mitigate CVE-2025-31281?

Within 24 hours: Inventory all Apple devices running affected versions (iOS/iPadOS 18.0-18.5, macOS Sequoia 15.0-15.5, tvOS 18.0-18.5, visionOS 2.0-2.5) and restrict user access to untrusted file sources pending patch availability. Within 7 days: Establish daily vendor advisory monitoring for patch release announcements; communicate risk assessment and interim controls to business units dependent on Apple devices. Within 30 days: Deploy vendor patches to iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, and visionOS 2.6 immediately upon release; prioritize devices handling sensitive data.

iOS CVE-2025-31281

CRITICAL

Improper Input Validation (CWE-20)

2025-07-30 product-security@apple.com

Apple iOS macOS Denial Of Service Ipados Iphone Os Tvos Visionos

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 02, 2026 - 19:37 vuln.today

CVE Published

Jul 30, 2025 - 00:15 nvd

CRITICAL 9.1

DescriptionCVE.org

An input validation issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6. Processing a maliciously crafted file may lead to unexpected app termination.

AnalysisAI

Memory handling flaws in Apple's operating systems allow unauthenticated remote attackers to cause information disclosure and application crashes by sending maliciously crafted files. Affects iOS 18.x prior to 18.6, iPadOS 18.x prior to 18.6, macOS Sequoia prior to 15.6, tvOS prior to 18.6, and visionOS prior to 2.6. CVSS 9.1 (Critical) reflects network-accessible attack vector with no authentication required, though EPSS probability remains low at 0.12% (32nd percentile), and no public exploit or active exploitation confirmed at time of analysis.

Technical ContextAI

This vulnerability stems from inadequate input validation (CWE-20) during processing of file content, resulting in improper memory handling that can be exploited remotely. The affected components span Apple's entire operating system ecosystem including iOS (cpe:2.3:o:apple:iphone_os), iPadOS (cpe:2.3:o:apple:ipados), macOS Sequoia (cpe:2.3:o:apple:macos), tvOS (cpe:2.3:o:apple:tvos), and visionOS (cpe:2.3:o:apple:visionos). Input validation vulnerabilities occur when applications fail to properly sanitize or validate data before processing, allowing attackers to trigger unintended program behavior. In this case, insufficient validation during file parsing leads to memory corruption that manifests as both confidentiality impacts (information disclosure through memory exposure) and availability impacts (application termination). The network attack vector (AV:N) suggests the vulnerability affects network-accessible services or applications that process remotely-supplied files, such as email attachments, web content, or file-sharing protocols.

RemediationAI

Vendor-released patches are available across all affected platforms and should be applied immediately. Upgrade to iOS 18.6 or iPadOS 18.6 for mobile devices, macOS Sequoia 15.6 for Mac computers, tvOS 18.6 for Apple TV devices, and visionOS 2.6 for Vision Pro headsets. Apply updates through standard Apple software update mechanisms (Settings > General > Software Update on iOS/iPadOS, System Settings > General > Software Update on macOS, or Settings > System > Software Updates on tvOS/visionOS). Enterprise administrators should deploy patches through Mobile Device Management (MDM) systems and validate deployment across managed fleets. Detailed security content documentation available at vendor advisories https://support.apple.com/en-us/124147, https://support.apple.com/en-us/124149, https://support.apple.com/en-us/124153, and https://support.apple.com/en-us/124154. No workarounds are provided; patching is the only definitive remediation.