CVE-2025-31201

KEVApple Multiple Products Arbitrary Read and Write Vulnerability

Description

Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

PublishedApr 16, 2025

Last modifiedJun 17, 2026

Added to KEVApr 17, 2025

Remediation dueMay 8, 2025

References

support.apple.com/en-us/122282Release NotesVendor Advisory
support.apple.com/en-us/122400Release NotesVendor Advisory
support.apple.com/en-us/122401Release NotesVendor Advisory
support.apple.com/en-us/122402Release NotesVendor Advisory
seclists.org/fulldisclosure/2025/Apr/26Mailing ListThird Party Advisory
seclists.org/fulldisclosure/2025/Jun/14Mailing ListThird Party Advisory
seclists.org/fulldisclosure/2025/Oct/0Mailing ListThird Party Advisory
seclists.org/fulldisclosure/2025/Oct/3Mailing ListThird Party Advisory
seclists.org/fulldisclosure/2025/Oct/4Mailing ListThird Party Advisory
github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201/blob/main/Remote%20Crypto%20Attack%20Chain%20.mdBroken LinkExploit
github.com/cisagov/vulnrichment/issues/200Issue Tracking
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31201US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 538 days
CVSS: 9.8 CRITICAL
EPSS (30-day exploit probability): 13.9% · top 3% of all CVEs
Weakness: CWE-1220
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.