Veille CVE
CVE-2025-31277
8.8 Élevée Exploitée activementCatalogue CISA KEV — Apple Multiple Products Buffer Overflow Vulnerability
Ajoutée le 20/03/2026 · Échéance de correction (agences US) : 03/04/2026
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
Produits concernés
- Apple Safari
- Apple iOS and iPadOS
- Apple macOS
- Apple tvOS
- Apple visionOS
- Apple watchOS
- Red Hat Enterprise Linux 7 Extended Lifecycle Support
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.2 Advanced Update Support
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
- Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service
- Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
- Red Hat Enterprise Linux 8.8 Telecommunications Update Service
- Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
- Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
- Red Hat Enterprise Linux 9.4 Extended Update Support
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Apple ipados
- Apple iphone os
- Webkitgtk webkitgtk
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 8.8 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | 8.8 Élevée | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://support.apple.com/en-us/124147 Release NotesVendor Advisory
- https://support.apple.com/en-us/124149 Release NotesVendor Advisory
- https://support.apple.com/en-us/124152 Release NotesVendor Advisory
- https://support.apple.com/en-us/124153 Release NotesVendor Advisory
- https://support.apple.com/en-us/124154 Release NotesVendor Advisory
- https://support.apple.com/en-us/124155 Release NotesVendor Advisory
- http://seclists.org/fulldisclosure/2025/Aug/0 Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2025/Jul/30 Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2025/Jul/32 Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2025/Jul/36 Mailing ListThird Party Advisory
- https://access.redhat.com/errata/RHSA-2025:17643 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:17741 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:17743 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:17802 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:17807 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:18097 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:19109 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:19157 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:19165 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:19352 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-31277 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2448780 Third Party Advisory
- https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain/ Technical Description
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-31277.json Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31277 US Government Resource