Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.7
CVE-2025-31257: Safari and Apple OSs may crash from malicious web page
CVE-2025-31257 · published 1 year ago
Summary
Safari on iPhone, iPad, Mac, Apple TV, Vision, and Apple Watch can unexpectedly close when it loads specially crafted web content. This could interrupt users but does not expose data. Update to the latest versions (Safari 18.5, iOS 18.5, iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5) to fix the issue.
What to do
- Update debian webkit2gtk to version 2.48.3-1~deb11u1.
- Update debian webkit2gtk to version 2.48.3-1~deb12u1.
- Update debian webkit2gtk to version 2.48.2-1.
- Update debian wpewebkit to version 2.48.2-1.
- Update canonical webkit2gtk to version 2.48.3-0ubuntu0.22.04.1.
- Update canonical webkit2gtk to version 2.48.3-0ubuntu0.24.04.1.
- Update apple safari to version 18.5 or later.
- Update apple ipados to version 18.5 or later.
- Update apple iphone_os to version 18.5 or later.
- Update apple macos to version 15.5 or later.
- Update apple tvos to version 18.5 or later.
- Update apple visionos to version 2.5 or later.
- Update apple watchos to version 11.5 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | apple | safari |
< 18.5 cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* |
| – | apple | ipados |
< 18.5 cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* |
| – | apple | iphone_os |
< 18.5 cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
| – | apple | macos |
< 15.5 cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| – | apple | tvos |
< 18.5 cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* |
| – | apple | visionos |
< 2.5 cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* |
| – | apple | watchos |
< 11.5 cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* |
| Debian:11 | debian | webkit2gtk |
< 2.48.3-1~deb11u1 Fix: upgrade to 2.48.3-1~deb11u1
|
| Debian:12 | debian | webkit2gtk |
< 2.48.3-1~deb12u1 Fix: upgrade to 2.48.3-1~deb12u1
|
| Debian:13 | debian | webkit2gtk |
< 2.48.2-1 Fix: upgrade to 2.48.2-1
|
| Debian:14 | debian | webkit2gtk |
< 2.48.2-1 Fix: upgrade to 2.48.2-1
|
| Debian:11 | debian | wpewebkit | All versions |
| Debian:12 | debian | wpewebkit | All versions |
| Debian:13 | debian | wpewebkit |
< 2.48.2-1 Fix: upgrade to 2.48.2-1
|
| Debian:14 | debian | wpewebkit |
< 2.48.2-1 Fix: upgrade to 2.48.2-1
|
| Ubuntu:16.04:LTS | canonical | qtwebkit-source | All versions |
| Ubuntu:16.04:LTS | canonical | webkitgtk | All versions |
| Ubuntu:16.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:16.04:LTS | canonical | webkit2gtk | All versions |
| Ubuntu:18.04:LTS | canonical | webkit2gtk | All versions |
| Ubuntu:18.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:18.04:LTS | canonical | qtwebkit-source | All versions |
| Ubuntu:18.04:LTS | canonical | webkitgtk | All versions |
| Ubuntu:20.04:LTS | canonical | webkit2gtk | All versions |
| Ubuntu:20.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:20.04:LTS | canonical | wpewebkit | All versions |
| Ubuntu:22.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:22.04:LTS | canonical | webkit2gtk |
< 2.48.3-0ubuntu0.22.04.1 Fix: upgrade to 2.48.3-0ubuntu0.22.04.1
|
| Ubuntu:22.04:LTS | canonical | wpewebkit | All versions |
| Ubuntu:24.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:24.04:LTS | canonical | webkit2gtk |
< 2.48.3-0ubuntu0.24.04.1 Fix: upgrade to 2.48.3-0ubuntu0.24.04.1
|
Original advisory text
This issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing malicious...
This issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References
- https://security-tracker.debian.org/tracker/CVE-2025-31257 Vendor Advisory
- http://seclists.org/fulldisclosure/2025/May/7
- https://support.apple.com/en-us/122404 Release Notes Vendor Advisory
- https://support.apple.com/en-us/122716 Release Notes Vendor Advisory
- https://support.apple.com/en-us/122719 Release Notes Vendor Advisory
- https://support.apple.com/en-us/122720 Release Notes Vendor Advisory
- https://support.apple.com/en-us/122721 Release Notes Vendor Advisory
- https://support.apple.com/en-us/122722 Release Notes Vendor Advisory
- http://seclists.org/fulldisclosure/2025/May/11
- http://seclists.org/fulldisclosure/2025/May/12
- http://seclists.org/fulldisclosure/2025/May/13
- http://seclists.org/fulldisclosure/2025/May/5
- https://lists.debian.org/debian-lts-announce/2025/06/msg00016.html
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
- https://ubuntu.com/security/CVE-2025-31257 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-31257 Third Party Advisory
- https://webkitgtk.org/security/WSA-2025-0004.html Third Party Advisory
- https://ubuntu.com/security/notices/USN-7566-1 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-119Buffer Overflow
Timeline
Published12 May 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta