CVE-2025-31200

This is like a booby-trapped audio file: if an attacker gets you to open or play it, it can corrupt the device's memory and let them take full control, no password needed, no obvious warning sign. It's similar to a rigged voicemail that secretly hands over the keys to your phone or computer the moment you listen to it.

This matters to you if your business uses iPhones, iPads, Macs, Apple Watches, Apple TVs, or Apple Vision Pro devices that haven't been updated recently. Attackers only need the victim to open a malicious media file — no login or special access is required beforehand.

Attackers are already exploiting this flaw in real-world attacks, and it's on CISA's confirmed-exploited list with a federal deadline to fix it by May 8, 2025 — treat this as an active threat, not a theoretical one. A working exploit method is also publicly available, increasing the chance of broader attacks beyond the original targeted victims.

1. Inventory all Apple devices (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) in use across the organization, including BYOD devices with corporate access.
2. Confirm current OS build via Settings > General > About (or System Information on macOS).
3. Upgrade to the fixed versions: iOS/iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5 or later — no breaking changes reported for this point release.
4. Prioritize devices belonging to executives, legal, or anyone handling sensitive data, given reports of targeted sophisticated attacks.
5. If immediate patching isn't possible, restrict receipt of unsolicited media/audio files (e.g., via MDM content filtering) as a stopgap — this is not a full mitigation.
6. CISA KEV remediation due date was 2025-05-08; treat any still-unpatched device as overdue and high priority.
7. Monitor Apple security advisories and MDM compliance reports for update adoption; a public PoC exists, so expect exploit attempts to broaden beyond the original sophisticated/targeted campaign.

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:R(file open)/S:U/C:H/I:H/A:H. Weakness: out-of-bounds write/buffer overflow (CWE-787, CWE-119) in media framework audio-stream parsing, triggered by processing a crafted file — remote, unauthenticated, requires only that the victim open/process the file. Confirmed in CISA KEV (added 2025-04-17, due 2025-05-08), with Apple acknowledging exploitation in an extremely sophisticated targeted attack prior to the fix. A public PoC on GitHub exists, and EPSS trend is rising, though exploitation status (KEV) supersedes EPSS as the operative urgency signal. No authentication or privilege is needed; exploit maturity is active/confirmed rather than theoretical.