peter bassill · operator
$ cve CVE-2025-31277 JSON

CVE-2025-31277 KEV

8.8
HIGH · CVSS 3.1 · EPSS 1.6% (pctl 75)

Patch first

On CISA KEV — known exploited in the wild, due 2026-04-03.

Description

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

Scoring

CVSS8.8 (HIGH, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS1.63% — more likely to be exploited than 75% of all CVEs
WeaknessCWE-119
On CISA KEVyes — remediate by 2026-04-03
Public exploitnone known
Published2025-07-30
Last modified2026-09-21

CISA KEV

NameApple Multiple Products Buffer Overflow Vulnerability
Added2026-03-20
Due2026-04-03
Vendor / productApple / Multiple Products
Ransomware usenone reported

Affected (15)

VendorProduct
appleipados
appleiphone os
applemacos
applesafari
appletvos
applevisionos
applewatchos
redhatenterprise linux
redhatenterprise linux aus
redhatenterprise linux els
redhatenterprise linux eus
redhatenterprise linux tus
redhatenterprise linux update services for sap solutions
webkitgtkwebkitgtk
wpewebkitwpe webkit

References

→ the Explorer  ·  watch your stack  ·  NVD