Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2025-31206: Safari and Apple OSes may crash from malicious web content
CVE-2025-31206 · published 1 year ago
Summary
Safari on iPhone, iPad, Mac, Apple TV, Vision, and Watch can shut down unexpectedly when it loads specially crafted web pages. This can cause interruptions for users but does not expose data. Updating to the latest software releases for Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS resolves the issue.
What to do
- Update debian webkit2gtk to version 2.48.3-1~deb11u1.
- Update debian webkit2gtk to version 2.48.3-1~deb12u1.
- Update debian webkit2gtk to version 2.48.2-1.
- Update debian wpewebkit to version 2.48.2-1.
- Update canonical webkit2gtk to version 2.48.3-0ubuntu0.22.04.1.
- Update canonical webkit2gtk to version 2.48.3-0ubuntu0.24.04.1.
- Update apple safari to version 18.5 or later.
- Update apple iphone_os to version 18.5 or later.
- Update apple macos to version 15.5 or later.
- Update apple tvos to version 18.5 or later.
- Update apple visionos to version 2.5 or later.
- Update apple watchos to version 11.5 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | apple | safari |
< 18.5 cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* |
| – | apple | ipados |
< 17.7.7 >= 18.0, < 18.5 cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* |
| – | apple | iphone_os |
< 18.5 cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
| – | apple | macos |
< 15.5 cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| – | apple | tvos |
< 18.5 cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* |
| – | apple | visionos |
< 2.5 cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* |
| – | apple | watchos |
< 11.5 cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* |
| Debian:11 | debian | webkit2gtk |
< 2.48.3-1~deb11u1 Fix: upgrade to 2.48.3-1~deb11u1
|
| Debian:12 | debian | webkit2gtk |
< 2.48.3-1~deb12u1 Fix: upgrade to 2.48.3-1~deb12u1
|
| Debian:13 | debian | webkit2gtk |
< 2.48.2-1 Fix: upgrade to 2.48.2-1
|
| Debian:14 | debian | webkit2gtk |
< 2.48.2-1 Fix: upgrade to 2.48.2-1
|
| Debian:11 | debian | wpewebkit | All versions |
| Debian:12 | debian | wpewebkit | All versions |
| Debian:13 | debian | wpewebkit |
< 2.48.2-1 Fix: upgrade to 2.48.2-1
|
| Debian:14 | debian | wpewebkit |
< 2.48.2-1 Fix: upgrade to 2.48.2-1
|
| Ubuntu:16.04:LTS | canonical | qtwebkit-source | All versions |
| Ubuntu:16.04:LTS | canonical | webkitgtk | All versions |
| Ubuntu:16.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:16.04:LTS | canonical | webkit2gtk | All versions |
| Ubuntu:18.04:LTS | canonical | webkit2gtk | All versions |
| Ubuntu:18.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:18.04:LTS | canonical | qtwebkit-source | All versions |
| Ubuntu:18.04:LTS | canonical | webkitgtk | All versions |
| Ubuntu:20.04:LTS | canonical | webkit2gtk | All versions |
| Ubuntu:20.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:20.04:LTS | canonical | wpewebkit | All versions |
| Ubuntu:22.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:22.04:LTS | canonical | webkit2gtk |
< 2.48.3-0ubuntu0.22.04.1 Fix: upgrade to 2.48.3-0ubuntu0.22.04.1
|
| Ubuntu:22.04:LTS | canonical | wpewebkit | All versions |
| Ubuntu:24.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:24.04:LTS | canonical | webkit2gtk |
< 2.48.3-0ubuntu0.24.04.1 Fix: upgrade to 2.48.3-0ubuntu0.24.04.1
|
Original advisory text
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS ...
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References
- https://security-tracker.debian.org/tracker/CVE-2025-31206 Vendor Advisory
- https://ubuntu.com/security/CVE-2025-31206 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-31206 Third Party Advisory
- https://webkitgtk.org/security/WSA-2025-0004.html Third Party Advisory
- https://ubuntu.com/security/notices/USN-7566-1 Vendor Advisory
- https://support.apple.com/en-us/122404 Release Notes Vendor Advisory
- https://support.apple.com/en-us/122405 Release Notes Vendor Advisory
- https://support.apple.com/en-us/122716 Release Notes Vendor Advisory
- https://support.apple.com/en-us/122719 Release Notes Vendor Advisory
- https://support.apple.com/en-us/122720 Release Notes Vendor Advisory
- https://support.apple.com/en-us/122721 Release Notes Vendor Advisory
- https://support.apple.com/en-us/122722 Release Notes Vendor Advisory
- http://seclists.org/fulldisclosure/2025/May/10
- http://seclists.org/fulldisclosure/2025/May/12
- http://seclists.org/fulldisclosure/2025/May/13
- http://seclists.org/fulldisclosure/2025/May/5
- http://seclists.org/fulldisclosure/2025/May/6
- http://seclists.org/fulldisclosure/2025/May/7
- https://lists.debian.org/debian-lts-announce/2025/06/msg00016.html
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-843Type Confusion
Timeline
Published12 May 2025
Updated31 Oct 2026
First seen7 Mar 2026
Track software like this
Free during beta