Product:
Safari
Summary
The issue was addressed with improved memory handling. Processing maliciously crafted web content may lead to memory corruption. This issue is fixed in multiple Apple operating systems including iOS and macOS.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-31277 |
Exploitation
An attacker can exploit this vulnerability by crafting malicious web content that, when processed by the affected product, can lead to memory corruption. This requires user interaction, as the user must visit a specially crafted website. Once the user interacts with the content, it can trigger the vulnerability and potentially allow the attacker to execute arbitrary code.
Affected Products
- Safari: Vulnerable to memory corruption when processing malicious web content.
- iOS: Affected version allows exploitation through crafted web content.
- iPadOS: Similar vulnerabilities as iOS, leading to potential memory corruption.
- macOS Sequoia: Vulnerable to the same memory handling issues.
- watchOS: Affected by the same memory corruption vulnerabilities.
- tvOS: Also vulnerable to exploitation through crafted web content.
- visionOS: Affected by the same issues as other operating systems.
Mitigation
To mitigate this vulnerability, users should apply the latest updates as per vendor instructions. Following applicable BOD 22-01 guidance for cloud services is recommended. If mitigations are unavailable, discontinuing use of the affected product is advised.
References
- Apple Release Notes 1
- Apple Release Notes 2
- Apple Release Notes 3
- Apple Release Notes 4
- Apple Release Notes 5
- Apple Release Notes 6
- Full Disclosure August 2025
- Full Disclosure July 30, 2025
- Full Disclosure July 32, 2025
- Full Disclosure July 36, 2025
- Darksword iOS Exploit Chain
- CISA Known Exploited Vulnerabilities