CVE-2025-31200: listed in the CISA KEV catalog

CVE-2025-31200 · CVSS 9.8 CRITICAL · EPSS 19% · KEV 2025-04-17 · patch available

A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.

Is CVE-2025-31200 exploited?

• Listed in the CISA KEV catalog on 2025-04-17.
• Federal remediation due 2025-05-08.
• Past that date by 519 days.
• EPSS puts exploitation in the next 30 days at 19%.

Which products and versions are affected?

• Apple · iOS and iPadOS · >= 0, < 18.4.1
• Apple · macOS · >= 0, < 15.4.1
• Apple · tvOS · >= 0, < 18.4.1
• Apple · visionOS · >= 0, < 2.4.1
• Apple · watchOS · >= 0, < 11.5
• apple · iphone os · < 18.4.1

Is there a patch?

• iphone os 18.4.1

What PlainSec published about CVE-2025-31200

• P7 DarkSword reaches into SpringBoard and wallet data (2026-10-09)

Primary sources

• NVD record
• CISA KEV catalog

What this record does not say

• No exploit assessment.

KEV and EPSS are re-checked daily. Record last updated 2026-10-09.