The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
Is CVE-2025-31277 exploited?
Listed in the CISA KEV catalog on 2026-03-20.
Federal remediation due 2026-04-03.
Past that date by 150 days.
EPSS puts exploitation in the next 30 days at 1%.
Public exploit code: none found in monitored sources.
Which products and versions are affected?
Apple · Safari · >= 0, < 18.6
Apple · iOS and iPadOS · >= 0, < 18.6
Apple · macOS · >= 0, < 15.6
Apple · tvOS · >= 0, < 18.6
Apple · visionOS · >= 0, < 2.6
Apple · watchOS · >= 0, < 11.6
Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Support
Red Hat · Red Hat Enterprise Linux 8
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Support
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Red Hat · Red Hat Enterprise Linux 8.6 Telecommunications Update Service
Red Hat · Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Red Hat · Red Hat Enterprise Linux 9
Red Hat · Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Red Hat · Red Hat Enterprise Linux 9.4 Extended Update Support