How severe is CVE-2025-31201?

CVE-2025-31201 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-31201 being actively exploited?

Yes. CVE-2025-31201 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2025-04-17, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2025-31201?

CVE-2025-31201 primarily affects Apple Macos. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2025-31201?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

Does CVE-2025-31201 have an EU (EUVD) identifier?

Yes. CVE-2025-31201 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-11381. It is also flagged as exploited in the EUVD (since 2025-04-17).

When was CVE-2025-31201 published?

CVE-2025-31201 was published on 2025-04-16 and last updated on 2026-06-17.

CVE-2025-31201

CVE-2025-31201 is a critical-severity vulnerability in Apple Macos with a CVSS 3.x base score of 9.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2025-04-17). The underlying weakness is classified as CWE-1220.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 13% (96th percentile)
Actively exploited: Yes — listed in CISA KEV (added 2025-04-17)
EU (EUVD) id: EUVD-2025-11381
EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2025-04-17)
Weakness: CWE-1220
Affected product: Apple Macos
Published: 2025-04-16
Last modified: 2026-06-17

Description

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.

Frequently asked questions

What is CVE-2025-31201?: This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.
How severe is CVE-2025-31201?: CVE-2025-31201 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-31201 being actively exploited?: Yes. CVE-2025-31201 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2025-04-17, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2025-31201?: CVE-2025-31201 primarily affects Apple Macos. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2025-31201?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2025-31201 have an EU (EUVD) identifier?: Yes. CVE-2025-31201 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-11381. It is also flagged as exploited in the EUVD (since 2025-04-17).
When was CVE-2025-31201 published?: CVE-2025-31201 was published on 2025-04-16 and last updated on 2026-06-17.

References

Affected products (5)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

More vulnerabilities in Apple Macos

CVE-2025-43300 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS…
CVE-2025-24201 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in…
CVE-2025-24085 — Critical (CVSS 10.0): A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3,…
CVE-2024-44148 — Critical (CVSS 10.0): This issue was addressed with improved validation of file attributes. This issue is fixed in macOS Sequoia 15. An app…
CVE-2024-44146 — Critical (CVSS 10.0): A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15. An app may be able to…
CVE-2023-40455 — Critical (CVSS 10.0): A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed…

All CVEs affecting Apple Macos →

Other CWE-1220 vulnerabilities

CVE-2022-2475 — Critical (CVSS 9.8): Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q…
CVE-2026-6356 — Critical (CVSS 9.6): A vulnerability in the web application allows standard users to escalate their privileges to those of a super…
CVE-2026-6388 — Critical (CVSS 9.1): A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify…
CVE-2025-8053 — Critical (CVSS 9.1): Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured…
CVE-2025-7493 — Critical (CVSS 9.1): A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to…
CVE-2025-4404 — Critical (CVSS 9.1): A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to…

Browse all CWE-1220 vulnerabilities →