Product:
tvOS, macOS, watchOS, iOS, iPadOS
Summary
An authorization issue was addressed with improved state management. This issue allows an app to potentially access sensitive user data. The issue has been fixed in multiple Apple operating systems including tvOS 26 and macOS Sonoma 14.8.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-31255 |
Exploitation
To exploit this vulnerability, an attacker could create a malicious application that takes advantage of the authorization issue. By tricking users into installing the app, the attacker could gain unauthorized access to sensitive user data without requiring any user interaction.
Affected Products
- tvOS 26: The latest version of Apple’s TV operating system.
- macOS Sonoma: The 14.8 version of Apple’s desktop operating system.
- macOS Sequoia: The 15.7 version of Apple’s desktop operating system.
- watchOS 26: The latest version of Apple’s smartwatch operating system.
- macOS Tahoe: The 26 version of Apple’s desktop operating system.
- iOS 26: The latest version of Apple’s mobile operating system.
- iPadOS 26: The latest version of Apple’s tablet operating system.
Mitigation
To mitigate this vulnerability, users should ensure that their devices are updated to the latest versions of the operating systems mentioned. Regularly checking for updates and applying them promptly can help protect against potential exploitation.