high8.8Known exploited
CVE-2025-31277
Apple Multiple Products Buffer Overflow Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-03-20. Federal due date: 2026-04-03.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Safari | before 18.6 |
| Apple | Ipados | before 18.6 |
| Apple | Iphone Os | before 18.6 |
| Apple | Macos | from 15.0 before 15.6 |
| Apple | Tvos | before 18.6 |
| Apple | Visionos | before 2.6 |
| Apple | Watchos | before 11.6 |
| Webkitgtk | Webkitgtk | before 2.50.0 |
| Wpewebkit | Wpe Webkit | before 2.50.0 |
| Redhat | Enterprise Linux | Versions 6.0, 7.0, 8.0, 9.0 |
| Redhat | Enterprise Linux Aus | Versions 8.2, 8.4, 8.6 |
| Redhat | Enterprise Linux Els | Version 7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://support.apple.com/en-us/124147
- https://support.apple.com/en-us/124149
- https://support.apple.com/en-us/124152
- https://support.apple.com/en-us/124153
- https://support.apple.com/en-us/124154
- https://support.apple.com/en-us/124155
- http://seclists.org/fulldisclosure/2025/Aug/0
- http://seclists.org/fulldisclosure/2025/Jul/30
- http://seclists.org/fulldisclosure/2025/Jul/32
- http://seclists.org/fulldisclosure/2025/Jul/36
- https://access.redhat.com/errata/RHSA-2025:17643
- https://access.redhat.com/errata/RHSA-2025:17741
- https://access.redhat.com/errata/RHSA-2025:17743
- https://access.redhat.com/errata/RHSA-2025:17802
- https://access.redhat.com/errata/RHSA-2025:17807
- https://access.redhat.com/errata/RHSA-2025:18097
- https://access.redhat.com/errata/RHSA-2025:19109
- https://access.redhat.com/errata/RHSA-2025:19157
- https://access.redhat.com/errata/RHSA-2025:19165
- https://access.redhat.com/errata/RHSA-2025:19352
- https://access.redhat.com/security/cve/CVE-2025-31277
- https://bugzilla.redhat.com/show_bug.cgi?id=2448780
- https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-31277.json
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31277