MSRXVulnerabilities / CVE-2025-31277
CVE-2025-31277
Published 2025-07-29 · published (not yet in NVD)
CVE-2025-31277
Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-03-20, with a fix-by date of 2026-04-03. Patch it first.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
8.8 HIGH
CVSS 3.1 · CNA
CVSS 3.1 · CNA
1.7%
chance of exploitation in the next 30 days (EPSS; higher than 76% of CVEs)
chance of exploitation in the next 30 days (EPSS; higher than 76% of CVEs)
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
Scores
Affected products
- Apple Safari: < 18.6
- Apple iOS and iPadOS: < 18.6
- Apple macOS: < 15.6
- Apple tvOS: < 18.6
- Apple visionOS: < 2.6
- Apple watchOS: < 11.6
6 references (advisories, patches, write-ups)
Sources: CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.