Search/CVE-2025-31277
● CVE — High

CVE-2025-31277

Vendorredhat, apple, webkitgtk, wpewebkitProductenterprise linux, enterprise linux eus, enterprise linux update services for sap solutions, macos, enterprise linux aus, iphone os, tvos, watchos, safari, webkitgtk, wpe webkit, enterprise linux tus, ipados, visionos, enterprise linux elsDiscoveredJul 30, 2025UpdatedSep 21, 2026

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

View graph Watch Export
CVSS v3.1
8.8 HIGH
EPSS
1.68%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
1
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 31, 2026
▲ 0.20pp
1.48% → 1.68% over 6 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Connections
18 relationships
Timeline
disclosure → media coverage
Jul 30, 2025
Disclosure — published as a CVE record. · last revised by NVD Sep 21, 2026
Mar 21, 2026
thehackernews.com reports: CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026
Public PoC (2)
github.com/stationedK-06/DarkSword_analysisgithub.com/hoarseprairie/CVE-2025-31277-WebKit-Memory-Corruption-Patch-Bypass
Unverified third-party code — review before executing.