CVE Feed

    Dashboard / CVE / CVE-2025-31277

    CVE-2025-31277

    The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

    Published:Jul 29, 2025
    Last Modified:Apr 3, 2026
    EPS:Jul 29, 2025
    EPSS Score:0.00192
    CVSS Score:8.8

    CISA Notification

    Description

    The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

    Required Action:

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

    Notes:

    No extra notes provided.

    Due Date
    Apr 3, 2026
    161 days ago
    Alert Date
    Mar 20, 2026
    175 days ago

    Affected Products

    Vendor
    Apple
    Product
    Ios
    Vendor
    Apple
    Product
    Ipados
    Vendor
    Apple
    Product
    Iphone Os
    Vendor
    Apple
    Product
    Macos
    Vendor
    Apple
    Product
    Macos Sequoia
    Vendor
    Apple
    Product
    Safari
    Vendor
    Apple
    Product
    Tvos
    Vendor
    Apple
    Product
    Visionos
    Vendor
    Apple
    Product
    Watchos
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Rhel Aus
    Vendor
    Redhat
    Product
    Rhel E4s
    Vendor
    Redhat
    Product
    Rhel Els
    Vendor
    Redhat
    Product
    Rhel Eus
    Vendor
    Redhat
    Product
    Rhel Eus Long Life
    Vendor
    Redhat
    Product
    Rhel Tus

    Exploits

    https://github.com/stationedK-06/DarkSword_analysis

    Related CVEs

    CVE-2026-20643 (CVSS 5.4) — A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed i…
    CVE-2025-46306 (CVSS 5.5) — The issue was addressed with improved bounds checks. This issue is fixed in Keynote 15.1, iOS 26 and iPadOS 26…
    CVE-2025-46316 (CVSS 4.3) — An out-of-bounds read was addressed with improved input validation. This issue is fixed in Pages 15.1, iOS 26.…
    CVE-2021-47827 (CVSS 4.6) — WebSSH for iOS 14.16.10 contains a denial of service vulnerability in the mashREPL tool that allows attackers …
    CVE-2025-24090 (CVSS 3.3) — A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.…
    CVE-2025-24089 (CVSS 5.3) — A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.…
    CVE-2024-54556 (CVSS 2.4) — This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. A…
    CVE-2024-44238 (CVSS 7.8) — The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Se…
    CVE-2025-46298 (CVSS 6.5) — The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 26.2 and iPadOS…
    CVE-2025-46299 (CVSS 4.3) — A memory initialization issue was addressed with improved memory handling. This issue is fixed in Safari 26.2,…

    References

    https://support.apple.com/en-us/124147
    https://support.apple.com/en-us/124149
    https://support.apple.com/en-us/124152
    https://support.apple.com/en-us/124153
    https://support.apple.com/en-us/124154
    https://support.apple.com/en-us/124155
    http://seclists.org/fulldisclosure/2025/Aug/0
    http://seclists.org/fulldisclosure/2025/Jul/30
    http://seclists.org/fulldisclosure/2025/Jul/32
    http://seclists.org/fulldisclosure/2025/Jul/36
    https://access.redhat.com/errata/RHSA-2025:17643
    https://access.redhat.com/errata/RHSA-2025:17741
    https://access.redhat.com/errata/RHSA-2025:17743
    https://access.redhat.com/errata/RHSA-2025:17802
    https://access.redhat.com/errata/RHSA-2025:17807
    https://access.redhat.com/errata/RHSA-2025:18097
    https://access.redhat.com/errata/RHSA-2025:19109
    https://access.redhat.com/errata/RHSA-2025:19157
    https://access.redhat.com/errata/RHSA-2025:19165
    https://access.redhat.com/errata/RHSA-2025:19352
    https://access.redhat.com/security/cve/CVE-2025-31277
    https://bugzilla.redhat.com/show_bug.cgi?id=2448780
    https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/
    https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-31277.json
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31277

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High