# CVE-2025-31277: Apple Multiple Products Buffer Overflow Vulnerability

> CVE-2025-31277: Apple Multiple Products Buffer Overflow Vulnerability. CVSS 8.8 (CVSS 3.1), in CISA KEV.

Canonical: https://rewindex.com/cve/CVE-2025-31277
Last updated: 2026-09-21T19:09:17Z

- Published: 2025-07-29 23:29 UTC · Updated: 2026-09-21 19:09 UTC · Assigner: apple
- CVSS: 8.8 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS: 1.7%, 76th percentile (scored 2026-10-25)
- CISA KEV: yes, added 2026-03-20, federal due date 2026-04-03, ransomware use: Unknown

## Description

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

## CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

## Affected vendors and products

- Apple: iOS and iPadOS
- Apple: macOS
- Apple: Safari
- Apple: tvOS
- Apple: visionOS
- Apple: watchOS
- Red Hat: Red Hat Enterprise Linux 6
- Red Hat: Red Hat Enterprise Linux 7
- Red Hat: Red Hat Enterprise Linux 7 Extended Lifecycle Support
- Red Hat: Red Hat Enterprise Linux 8
- Red Hat: Red Hat Enterprise Linux 8.2 Advanced Update Support
- Red Hat: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
- Red Hat: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
- Red Hat: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
- Red Hat: Red Hat Enterprise Linux 8.6 Telecommunications Update Service
- Red Hat: Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
- Red Hat: Red Hat Enterprise Linux 8.8 Telecommunications Update Service
- Red Hat: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
- Red Hat: Red Hat Enterprise Linux 9
- Red Hat: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
- Red Hat: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
- Red Hat: Red Hat Enterprise Linux 9.4 Extended Update Support

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2025-31277)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2025-31277)
- [https://support.apple.com/en-us/124147](https://support.apple.com/en-us/124147)
- [https://support.apple.com/en-us/124149](https://support.apple.com/en-us/124149)
- [https://support.apple.com/en-us/124152](https://support.apple.com/en-us/124152)
- [https://support.apple.com/en-us/124153](https://support.apple.com/en-us/124153)
- [https://support.apple.com/en-us/124154](https://support.apple.com/en-us/124154)
- [https://support.apple.com/en-us/124155](https://support.apple.com/en-us/124155)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2025-31277 · Markdown: https://rewindex.com/cve/CVE-2025-31277.md · JSON: https://rewindex.com/api/v1/cves/CVE-2025-31277 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:11:06.063Z