Apple Buffer Overflow Vulnerability Fixed in Safari, iOS, macOS
Summary
CISA has added a buffer overflow vulnerability (CVE-2025-31277) affecting Apple products to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, which allows for memory corruption via maliciously crafted web content, has been addressed by Apple in recent software updates.
What changed
CISA has added CVE-2025-31277, a buffer overflow vulnerability in Apple's Safari, iOS, iPadOS, macOS, tvOS, and watchOS, to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, identified as CWE-119, allows for memory corruption through maliciously crafted web content and has a CVSS score of 8.8 (HIGH). Apple has released updates (Safari 18.6, iOS/iPadOS 18.6, macOS Sequoia 15.6, etc.) to address this issue.
Given its inclusion in the KEV catalog, federal agencies are required to apply available security patches to mitigate the risk of exploitation. All users, particularly those in federal agencies, should ensure their Apple devices are updated to the latest versions to protect against potential attacks. The KEV catalog indicates active exploitation, underscoring the urgency of applying these updates.
What to do next
- Update Apple devices to the latest software versions (Safari 18.6, iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, watchOS 11.6, visionOS 2.6).
- Federal agencies must apply available security patches as per CISA directives.
Source document (simplified)
Required CVE Record Information
CNA: Apple Inc.
Description
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, watchOS 11.6, visionOS 2.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6. Processing maliciously crafted web content may lead to memory corruption.
Product Status
Learn more Versions 1 Total
Default Status: unknown
affected
- affected before 18.6 Versions 1 Total
Default Status: unknown
affected
- affected before 15.6 Versions 1 Total
Default Status: unknown
affected
- affected before 18.6 Versions 1 Total
Default Status: unknown
affected
- affected before 2.6 Versions 1 Total
Default Status: unknown
affected
- affected before 11.6 Versions 1 Total
Default Status: unknown
affected
- affected before 18.6
References 6 Total
- https://support.apple.com/en-us/124152
- https://support.apple.com/en-us/124149
- https://support.apple.com/en-us/124153
- https://support.apple.com/en-us/124154
- https://support.apple.com/en-us/124155
- https://support.apple.com/en-us/124147
CVE Program
Updated:
2025-11-03
This container includes required additional information provided by the CVE Program for this vulnerability.
References 4 Total
- http://seclists.org/fulldisclosure/2025/Aug/0
- http://seclists.org/fulldisclosure/2025/Jul/36
- http://seclists.org/fulldisclosure/2025/Jul/32
- http://seclists.org/fulldisclosure/2025/Jul/30
Authorized Data Publishers
CISA-ADP
Updated:
2026-03-20
SSVC and KEV, plus CVSS and CWE if not provided by the CNA.
SSVC 2 Total
Learn more
| Exploitation | Automatable | Technical Impact | Version | Date Accessed |
| --- | --- | --- | --- | --- |
| none | no | total | 2.0.3 | 2025-07-31 |
| active | no | total | 2.0.3 | 2026-03-20 |
KEV 1 Total
Learn more
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31277 (2026-03-20)
CWE 1 Total
Learn more
- CWE-119: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS 1 Total
Learn more
| Score | Severity | Version | Vector String |
| --- | --- | --- | --- |
| 8.8 | HIGH | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Related changes
Source
Classification
Who this affects
Taxonomy
Browse Categories
Get Data Privacy & Cybersecurity alerts
Weekly digest. AI-summarized, no noise.
Free. Unsubscribe anytime.
Get alerts for this source
We'll email you when CISA ICS-CERT Advisories publishes new changes.