CVE-2025-31277 · CVSS 8.8 HIGH · EPSS 2% · KEV 2026-03-20 · patch available
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
Is CVE-2025-31277 exploited?
Listed in the CISA KEV catalog on 2026-03-20.
Federal remediation due 2026-04-03.
Past that date by 209 days.
EPSS puts exploitation in the next 30 days at 2%.
Public exploit code: none found in monitored sources.
Which products and versions are affected?
Apple · Safari · >= 0, < 18.6
Apple · iOS and iPadOS · >= 0, < 18.6
Apple · macOS · >= 0, < 15.6
Apple · tvOS · >= 0, < 18.6
Apple · visionOS · >= 0, < 2.6
Apple · watchOS · >= 0, < 11.6
apple · iphone os · < 18.6
webkitgtk · webkitgtk · < 2.50.0
wpewebkit · wpe webkit · < 2.50.0
redhat · enterprise linux · 6.0, 7.0, 8.0, 9.0
redhat · enterprise linux aus · 8.2, 8.4, 8.6
redhat · enterprise linux els · 7.0
redhat · enterprise linux eus · 8.4, 8.6, 9.4
redhat · enterprise linux tus · 8.6, 8.8
redhat · enterprise linux update services for sap solutions · 8.6, 8.8, 9.0, 9.2