← Back to browse · API

CVE-2025-31201

Severity
CRITICAL
CVSS
9.8
EPSS
0.14652
Risk score
69.33
CISA KEV
Yes
PoC
No
Published
2025-04-16
Modified
2026-04-02
First seen
2026-08-07
Aliases
EUVD-2025-11381, GHSA-Q4HH-VRVH-R4H7
Products
Apple:Multiple Products, Apple:iOS and iPadOS 0 <18.4.1, Apple:macOS 0 <15.4.1, Apple:tvOS 0 <18.4.1, Apple:visionOS 0 <2.4.1
Sources
euvd EUVD-2025-11381
cisa.gov CVE-2025-31201

Description

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.

References