Is CVE-2025-31200 being actively exploited?

Yes. CVE-2025-31200 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on April 17, 2025.

What is the CVSS score for CVE-2025-31200?

CVE-2025-31200 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2025-31200

CRITICAL · CVSS 9.8CISA KEV: actively exploitedEPSS 20.9%EU EUVD: exploited

A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-119
EPSS score: 20.9% (98th percentile)
In CISA KEV: Yes, added April 17, 2025
In EU EUVD: Yes (EUVD-2025-11380)
Published: April 16, 2025
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Apple Multiple Products Memory Corruption Vulnerability

Added to the KEV catalog on April 17, 2025; federal remediation due May 8, 2025.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2025-11380 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on April 2, 2026.

View on the EU Vulnerability Database

Affected products

apple / ipados
apple / iphone os
apple / macos
apple / tvos
apple / visionos
apple / watchos

Certified products that may be affected

21 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Apple macOS 15 Sequoia - Apple Inc. - Common Criteria CCEVS-VR-VID-11648-2026 - active
Strong Customer Authentication for Apple Pay on MacBook Air 2024 with M3running macOS Sequoia 15.4 - Apple Inc. - Common Criteria 2025-11-INF-4674 - active
Apple iOS 18: iPhone - Apple Inc. - Common Criteria CCEVS-VR-VID-11623-2025 - active
Apple iPadOS 18: iPad - Apple Inc. - Common Criteria CCEVS-VR-VID-11624-2025 - active
Strong Customer Authentication for Apple Pay on Mac mini with M4 running macOS Sequoia 15.4, paired with Magic keyboard with Touch ID(macOS Sequoia 15.4 (build 24E248)) (ANSSI-CC-2025/36) - Apple Inc. - Common Criteria ANSSI-CC-2025/36 - active

See all 21 in the Security Certifications Explorer.

References

http://seclists.org/fulldisclosure/2025/Apr/26(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2025/Jun/14(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2025/May/10(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2025/Oct/0(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2025/Oct/4(Mailing List, Third Party Advisory)
https://blog.noahhw.dev/posts/cve-2025-31200/(Broken Link, Exploit)
https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201/blob/main/Remote%20Crypto%20Attack%20Chain%20.md(Broken Link, Exploit)
https://github.com/cisagov/vulnrichment/issues/200(Issue Tracking)
https://news.ycombinator.com/item?id=44161894(Issue Tracking)
https://support.apple.com/en-us/122282(Release Notes, Vendor Advisory)
https://support.apple.com/en-us/122400(Release Notes, Vendor Advisory)
https://support.apple.com/en-us/122401(Release Notes, Vendor Advisory)
https://support.apple.com/en-us/122402(Release Notes, Vendor Advisory)
https://support.apple.com/en-us/122722(Release Notes, Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31200(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain