How severe is CVE-2025-31277?

CVE-2025-31277 has a CVSS score of 8.8/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by CVE-2025-31277?

Affected package information for CVE-2025-31277 is not yet fully mapped. Check the official advisory links for details.

How do I fix CVE-2025-31277?

No fixed release is recorded for CVE-2025-31277 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.

How do I detect CVE-2025-31277 in my code and dependencies?

Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).

How do I mitigate CVE-2025-31277 if there is no patch (or I can't update yet)?

Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.

Is CVE-2025-31277 actively exploited in the wild?

No public exploit code has been indexed for CVE-2025-31277 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2025-31277?

CVE-2025-31277 has an EPSS (Exploit Prediction Scoring System) score of 1.7%, placing it in the 76th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

Is CVE-2025-31277 in the CISA Known Exploited Vulnerabilities catalog?

Yes. CVE-2025-31277 (Apple Multiple Products Buffer Overflow Vulnerability) was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-03-20. CISA required all US federal civilian agencies to remediate this vulnerability by 2026-04-03. The required action was: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Being listed in the KEV catalog is the strongest possible confirmation of active exploitation — treat this as a critical priority.

What type of vulnerability is CVE-2025-31277?

CVE-2025-31277 is classified as Buffer Overflow (CWE-119), CWE-120 (CWE-120). These weakness types describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure.

When was CVE-2025-31277 published, and has it been updated?

CVE-2025-31277 was published on July 30, 2025 and was last updated on April 22, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🛡️

CISA KEV · ACTIVELY EXPLOITED

HIGH severity

CVE-2025-31277

HIGH

CVE-2025-31277 is a high-severity (CVSS 8.8) Buffer Overflow vulnerability. It is in CISA's Known Exploited Vulnerabilities catalog (added 2026-03-20) — treat it as actively exploited and patch now. No vendor fix is recorded yet; mitigation options are listed below.

Published

Jul 30, 2025

Updated

Apr 22, 2026

Affected

15 products

Patched

See advisory

Exploits

None indexed

Exploitation data as of Oct 26, 2026 · OSV.dev, NVD, CISA KEV, FIRST.org (EPSS)

Exploitation Status

Actively exploited in the wild

Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2026-03-20. Federal agencies were required to remediate by 2026-04-03.
A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2025-31277.

EPSS Exploitation Probability

via FIRST.org ↗

1.7%probability of exploitation in next 30 days

Lower Risk+0.05%

Lower risk than most CVEs76th percentile — riskier than 76% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2025-31277 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 396,257 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Description

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, watchOS 11.6, visionOS 2.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6. Processing maliciously crafted web content may lead to memory corruption.

Affected Products

15 products · 26 configurations

ipadosapple

< 18.6

range

iphone osapple

< 18.6

range

macosapple

≥ 15.0 && < 15.6

range

Application

safariapple

< 18.6

range

tvosapple

< 18.6

range

visionosapple

< 2.6

range

Detection & mitigation playbook

Vulnerability

Detect
Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).
Remediation status
No fixed release is recorded for CVE-2025-31277 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.
Mitigate without a patch
Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity. Additionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.

Workaround published by Red Hat

Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp. This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction. To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them…

Source: Red Hat security advisory for CVE-2025-31277 (CC BY 4.0)

Product	Fixed in	Advisory
Red Hat Enterprise Linux 7 Extended Lifecycle Support	`webkitgtk4-0:2.50.0-1.el7_9`	RHSA-2025:19352
Red Hat Enterprise Linux 8	`webkit2gtk3-0:2.50.0-1.el8_10`	RHSA-2025:17802
Red Hat Enterprise Linux 8.2 Advanced Update Support	`webkit2gtk3-0:2.50.0-1.el8_2`	RHSA-2025:19157
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	`webkit2gtk3-0:2.50.0-1.el8_4`	RHSA-2025:19165
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	`webkit2gtk3-0:2.50.0-1.el8_6`	RHSA-2025:19109
Red Hat Enterprise Linux 8.8 Telecommunications Update Service	`webkit2gtk3-0:2.50.0-1.el8_8.1`	RHSA-2025:17807
Red Hat Enterprise Linux 9	`webkit2gtk3-0:2.50.1-0.el9_6`	RHSA-2025:18097
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	`webkit2gtk3-0:2.50.0-2.el9_0`	RHSA-2025:17643

Frequently Asked Questions

O3 Security · Impact-Aware SCA

Is CVE-2025-31277 in your dependencies?

Find it across , including transitive dependencies.

Scan my dependencies How O3 SCA works

CVSS Score

8.8/10CVSS v3 base

Vector breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Raw vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE Classification

CWE-119Buffer Overflow CWE-120CWE-120

Weaponization

No known public exploit tooling found.

Timeline

Disclosed

Jul 30, 2025

KEV added

Mar 20, 2026

Last updated

Apr 22, 2026

Identifiers

CVE-2025-31277

References

Advisorysupport.apple.com Advisorysupport.apple.com Advisorysupport.apple.com Advisorysupport.apple.com Advisorysupport.apple.com Advisorysupport.apple.com Webseclists.org Webseclists.org Webseclists.org Webseclists.org

Related vulnerabilities

This CVE is high severity; 6 of 8 other CVEs with CWE-119 are rated as high or higher (top: high).

GHSA-qwgh-2vcv-g2f7CVE-2026-54559CVE-2022-46292CVE-2022-46293CVE-2025-10997CVE-2022-43467CVE-2022-46295CVE-2022-46291Browse all CWE-119

Provenance

Sources

OSV.devNVDCISA KEVFIRST.org (EPSS)

Last verifiedApr 22, 2026

CVE-2025-31277

Exploitation Status

Actively exploited in the wild

EPSS Exploitation Probability

How urgent is this, really

Where this sits among everything scored

Description

Affected Products

Detection & mitigation playbook

Detect

Remediation status

Mitigate without a patch

Fixing This On Your OS

Frequently Asked Questions

Is CVE-2025-31277 in your dependencies?