Main Vulnerability Database Vulnerabilities #VU107562

Buffer overflow in Apple iOS and iPadOS - CVE-2025-31200

Published: April 16, 2025 / Updated: April 17, 2026

Vulnerability identifier: #VU107562

CSH Severity: Critical

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-31200

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing audio stream in CoreAudio. A remote attacker can trick the victim into visiting a specially crafted website or playing a specially crafted video file, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Affected software

Apple iOS
iPadOS
visionOS
watchOS
macOS
tvOS

How to mitigate CVE-2025-31200

Install updates from vendor's website.

Apple iOS - update to 18.4.1 22E252
iPadOS - update to 18.4.1 22E252
iPadOS - update to
visionOS - update to 2.4.1
watchOS - update to 11.5
macOS - update to 15.4.1 24E263
tvOS - update to 18.4.1

Links to Public Exploits and PoC-codes

External References

https://support.apple.com/en-us/122282