CVE-2025-31201

CRITICALCISA KEV

9.8

Descripcion

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.

Detalles CVE

Puntuacion CVSS v3.19.8

SeveridadCRITICAL

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado4/16/2025

Ultima modificacion4/3/2026

Fuentekev

Avistamientos honeypot0

CISA KEV

VendedorApple

ProductoMultiple Products

Nombre vulnerabilidadApple Multiple Products Arbitrary Read and Write Vulnerability

Fecha inclusion KEV2025-04-17

Fecha limite remediacion2025-05-08

Uso en ransomwareUnknown

Productos afectados

apple:ipadosapple:iphone_osapple:macosapple:tvosapple:visionos

Debilidades (CWE)

CWE-1220

Referencias

https://support.apple.com/en-us/122282(product-security@apple.com)

https://support.apple.com/en-us/122400(product-security@apple.com)

https://support.apple.com/en-us/122401(product-security@apple.com)

https://support.apple.com/en-us/122402(product-security@apple.com)

http://seclists.org/fulldisclosure/2025/Apr/26(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2025/Jun/14(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2025/Oct/0(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2025/Oct/3(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2025/Oct/4(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201/blob/main/Remote%20Crypto%20Attack%20Chain%20.md(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://github.com/cisagov/vulnrichment/issues/200(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31201(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.