CVE-2025-31200
CRITICAL 9.8 KNOWN EXPLOITED ALL-YEARSA memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.
Confirmed exploited in the wild — in CISA KEV since 2025-04-17. Patch or mitigate now.
Exploitation likelihood
20.9%chance of exploitation in 30 days · 98th percentile
Impact if exploited
9.8CVSS 3.1 · CRITICAL · ADP
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References and research data (JSON)
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
4 candidates
- https://github.com/zhuowei/apple-positional-audio-codec-invalid-header
CVE-2025-31200 - @Noahhw46 figured it out
PoC-in-GitHub · CVE-2025-31200
PoC-in-GitHub · CVE-2025-31200 · Updated 2026-10-05T11:05:35Z - https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201
CVE-2025-31200 is a zero-day, zero-click RCE in iOS CoreAudio’s AudioConverterService, triggered by a malicious audio file via iMessage/SMS. Exploitation bypassed Blastdoor, enabled kernel escalation (CVE-2025-31201), and allowed token theft until patched in iOS 18.4.1 (Apr 16, 2025).
PoC-in-GitHub · CVE-2025-31200
PoC-in-GitHub · CVE-2025-31200 · Updated 2026-10-23T06:14:54Z - https://github.com/serundengsapi/CVE-2025-31200-iOS-AudioConverter-RCE
Public disclosure of CVE-2025-31200 – Zero-click RCE in iOS 18.X via AudioConverterService and malicious audio file.
PoC-in-GitHub · CVE-2025-31200
PoC-in-GitHub · CVE-2025-31200 · Updated 2026-04-14T06:14:21Z - https://github.com/hunters-sec/CVE-2025-31200
IOS audio buffer overflow CVE-2025-31200 POC
PoC-in-GitHub · CVE-2025-31200
PoC-in-GitHub · CVE-2025-31200 · Updated 2026-09-09T01:43:53Z
Additional exploitation reports
Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.
- VulnCheck KEV · 2025-04-16T00:00:00Z
Source guidance: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Source ransomware assessment: Unknown
VulnCheck KEV · CVE-2025-31200 · Updated 2025-04-16T00:00:00Z - VulnCheck KEV · 2025-04-16T00:00:00ZVulnCheck KEV · CVE-2025-31200
VulnCheck KEV · CVE-2025-31200
VulnCheck KEV · CVE-2025-31200
VulnCheck KEV · CVE-2025-31200
VulnCheck KEV · CVE-2025-31200
VulnCheck KEV · CVE-2025-31200
VulnCheck KEV · CVE-2025-31200 - VulnCheck KEV · 2025-04-17T00:00:00ZVulnCheck KEV · CVE-2025-31200
- VulnCheck KEV · 2025-12-11T00:00:00ZVulnCheck KEV · CVE-2025-31200
- VulnCheck KEV · 2026-01-20T00:00:00ZVulnCheck KEV · CVE-2025-31200
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Apple | Macos | ≥ 15.0 and < 15.4.1 |
| Apple | Tvos | < 18.4.1 |
| Apple | Visionos | < 2.4.1 |
| Apple | Ipados | < 18.4.1 |
| Apple | Iphone Os | < 18.4.1 |
| Apple | Watchos | < 11.5 |
All CVSS metrics
- CRITICAL 9.8 v3.1 · ADP Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CRITICAL 9.8 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Exploit-tagged references (not proof of a PoC)
- https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201/blob/main/Remote%20Crypto%20Attack%20Chain%20.md CVE record · CISA-ADP · Updated 2026-02-26T18:28:12.610Z
NVD · CVE-2025-31200 · Updated 2026-06-17T09:10:00.550 - https://blog.noahhw.dev/posts/cve-2025-31200/ CVE record · CVE · Updated 2025-11-03T19:48:16.666Z
NVD · CVE-2025-31200 · Updated 2026-06-17T09:10:00.550
Advisories
- https://support.apple.com/en-us/122282 CVE record · apple · Updated 2026-04-02T18:25:21.000Z
NVD · CVE-2025-31200 · Updated 2026-06-17T09:10:00.550
VulnCheck KEV · CVE-2025-31200 · Updated 2025-04-16T00:00:00Z - https://support.apple.com/en-us/122400 CVE record · apple · Updated 2026-04-02T18:25:21.000Z
NVD · CVE-2025-31200 · Updated 2026-06-17T09:10:00.550
VulnCheck KEV · CVE-2025-31200 · Updated 2025-04-16T00:00:00Z - https://support.apple.com/en-us/122401 CVE record · apple · Updated 2026-04-02T18:25:21.000Z
NVD · CVE-2025-31200 · Updated 2026-06-17T09:10:00.550
VulnCheck KEV · CVE-2025-31200 · Updated 2025-04-16T00:00:00Z - https://support.apple.com/en-us/122402 CVE record · apple · Updated 2026-04-02T18:25:21.000Z
NVD · CVE-2025-31200 · Updated 2026-06-17T09:10:00.550
VulnCheck KEV · CVE-2025-31200 · Updated 2025-04-16T00:00:00Z - https://support.apple.com/en-us/122722 CVE record · apple · Updated 2026-04-02T18:25:21.000Z
NVD · CVE-2025-31200 · Updated 2026-06-17T09:10:00.550 - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31200 CVE record · CISA-ADP · Updated 2026-02-26T18:28:12.610Z
NVD · CVE-2025-31200 · Updated 2026-06-17T09:10:00.550 - http://seclists.org/fulldisclosure/2025/Oct/4 CVE record · CVE · Updated 2025-11-03T19:48:16.666Z
NVD · CVE-2025-31200 · Updated 2026-06-17T09:10:00.550 - http://seclists.org/fulldisclosure/2025/Oct/0 CVE record · CVE · Updated 2025-11-03T19:48:16.666Z
NVD · CVE-2025-31200 · Updated 2026-06-17T09:10:00.550 - http://seclists.org/fulldisclosure/2025/Jun/14 CVE record · CVE · Updated 2025-11-03T19:48:16.666Z
NVD · CVE-2025-31200 · Updated 2026-06-17T09:10:00.550 - http://seclists.org/fulldisclosure/2025/May/10 CVE record · CVE · Updated 2025-11-03T19:48:16.666Z
NVD · CVE-2025-31200 · Updated 2026-06-17T09:10:00.550 - http://seclists.org/fulldisclosure/2025/Apr/26 CVE record · CVE · Updated 2025-11-03T19:48:16.666Z
NVD · CVE-2025-31200 · Updated 2026-06-17T09:10:00.550 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-11380 EUVD · EUVD-2025-11380
- https://vulncheck.com/kev VulnCheck KEV · CVE-2025-31200 · Updated 2025-04-16T00:00:00Z
Technical & other
- https://github.com/cisagov/vulnrichment/issues/200 CVE record · CISA-ADP · Updated 2026-02-26T18:28:12.610Z
NVD · CVE-2025-31200 · Updated 2026-06-17T09:10:00.550 - https://news.ycombinator.com/item?id=44161894 CVE record · CVE · Updated 2025-11-03T19:48:16.666Z
NVD · CVE-2025-31200 · Updated 2026-06-17T09:10:00.550 - https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit VulnCheck KEV · CVE-2025-31200 · Updated 2025-04-16T00:00:00Z
- https://isc.sans.edu/diary/Apple%20Patches%20Exploited%20Vulnerability/31866 VulnCheck KEV · CVE-2025-31200 · Updated 2025-04-16T00:00:00Z
- https://x.com/craiu/status/1912608175364145652 VulnCheck KEV · CVE-2025-31200 · Updated 2025-04-16T00:00:00Z
- https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json VulnCheck KEV · CVE-2025-31200 · Updated 2025-04-16T00:00:00Z
- https://cyble.com/resources/research-reports/global-cybersecurity-report/ VulnCheck KEV · CVE-2025-31200 · Updated 2025-04-16T00:00:00Z
- https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025 VulnCheck KEV · CVE-2025-31200 · Updated 2025-04-16T00:00:00Z
Sources: NVD · CVE.org · All sources and attribution · EPSS