Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-31209: Apple iOS, iPadOS, macOS, tvOS, visionOS could expose data

CVE-2025-31209 · published 1 year ago

Summary

A flaw in the way these Apple operating systems read certain files could allow a program to see information it shouldn't. This could lead to user data being disclosed. Updating to the latest versions of iOS, iPadOS, macOS, tvOS, and visionOS resolves the issue.

What to do

Update apple iphone_os to version 18.5 or later.
Update apple tvos to version 18.5 or later.
Update apple visionos to version 2.5 or later.
Update apple watchos to version 11.5 or later.

Affected software

Vendor	Product	Affected versions
apple	ipados	< 17.7.7 >= 18.0, < 18.5 `cpe:2.3:o:apple:ipados::::::::`
apple	iphone_os	< 18.5 `cpe:2.3:o:apple:iphone_os::::::::`
apple	macos	< 13.7.6 >= 14.0, < 14.7.6 >= 15.0, < 15.5 `cpe:2.3:o:apple:macos::::::::`
apple	tvos	< 18.5 `cpe:2.3:o:apple:tvos::::::::`
apple	visionos	< 2.5 `cpe:2.3:o:apple:visionos::::::::`
apple	watchos	< 11.5 `cpe:2.3:o:apple:watchos::::::::`

Original advisory text

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Parsing a file may lead to disclosure of user information.

References

https://support.apple.com/en-us/122404 Release Notes Vendor Advisory
https://support.apple.com/en-us/122405 Release Notes Vendor Advisory
https://support.apple.com/en-us/122716 Release Notes Vendor Advisory
https://support.apple.com/en-us/122717 Release Notes Vendor Advisory
https://support.apple.com/en-us/122718 Release Notes Vendor Advisory
https://support.apple.com/en-us/122720 Release Notes Vendor Advisory
https://support.apple.com/en-us/122721 Release Notes Vendor Advisory
https://support.apple.com/en-us/122722 Release Notes Vendor Advisory
http://seclists.org/fulldisclosure/2025/May/10
http://seclists.org/fulldisclosure/2025/May/12
http://seclists.org/fulldisclosure/2025/May/5
http://seclists.org/fulldisclosure/2025/May/6
http://seclists.org/fulldisclosure/2025/May/8
http://seclists.org/fulldisclosure/2025/May/9

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published12 May 2025

Updated3 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-31209 · NVD

Track software like this

Free during beta