CVE-2025-31277
Published: 30 July 2025
Summary
CVE-2025-31277 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Apple Safari. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 37.9th percentile by exploit likelihood (below the median); CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Implements memory protection mechanisms like address space randomization and data execution prevention to directly mitigate memory corruption exploits in WebKit.
Requires timely identification, reporting, and remediation of flaws such as the inadequate memory handling fixed in Safari 18.6 and related Apple OS updates.
Deploys malicious code protection to scan and block web content that could trigger the WebKit memory corruption vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory corruption in WebKit enables RCE via malicious website visit (drive-by) and client-side exploitation.
NVD Description
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
Deeper analysisAI
CVE-2025-31277 is a memory corruption vulnerability (CWE-119) in Apple's WebKit rendering engine, stemming from inadequate memory handling. It affects Safari prior to version 18.6, as well as iOS and iPadOS prior to 18.6, macOS Sequoia prior to 15.6, tvOS prior to 18.6, visionOS prior to 2.6, and watchOS prior to 11.6. The issue, published on July 30, 2025, carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for full system compromise.
Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, but it necessitates user interaction, such as visiting a malicious website. Successful exploitation of the memory corruption could grant attackers high-impact control over confidentiality, integrity, and availability, potentially enabling arbitrary code execution, data theft, or persistent access on the targeted device.
Apple's security advisories confirm the vulnerability was addressed through improved memory handling in the listed patched versions. Security practitioners should prioritize updating affected Apple devices and advise users to avoid untrusted web content until patches are applied, as detailed in support documents at https://support.apple.com/en-us/124147, https://support.apple.com/en-us/124149, https://support.apple.com/en-us/124152, https://support.apple.com/en-us/124153, and https://support.apple.com/en-us/124154.
Details
- CWE(s)
- KEV Date Added
- 20 March 2026