CVE-2025-31201: Apple OS Pointer Authentication bypass via arbitrary read/write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.8, CISA KEV listing with a near-term due date, and Apple's acknowledgement of exploitation in targeted attacks make this a top remediation priority.

What it is

Apple removed vulnerable code that allowed an attacker holding arbitrary read and write capability to bypass Pointer Authentication across iOS, iPadOS, macOS, tvOS and visionOS. Pointer Authentication is a core control-flow integrity defense, so bypassing it undermines a key mitigation and can enable further exploitation. Apple states it is aware of a report that this may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.

Impact

An attacker who already has arbitrary read and write capability can defeat Pointer Authentication, weakening control-flow protections and enabling escalation toward code execution or full compromise of the device.

Attack surface

The CVSS vector is network-reachable with no privileges and no user interaction, but the description requires the attacker to already possess arbitrary read and write capability, so this is a post-compromise or chained primitive rather than a standalone remote entry point. It is reached on affected Apple operating systems; no specific delivery vector is given in the record.

Exploitation

Listed in CISA KEV (added 2025-04-17, due 2025-05-08) and Apple acknowledges a report of exploitation in a targeted attack; EPSS 30-day probability is 0.13853 (96th percentile). A public GitHub reference is tagged Exploit but also tagged Broken Link, so treat it as unverified.

What to do

• Update to iOS 18.4.1, iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1 or visionOS 2.4.1 as applicable, per Apple advisories.
• Prioritize patching for devices used by at-risk or targeted individuals, consistent with the KEV due date of 2025-05-08.
• Apply mitigations per vendor instructions or follow applicable BOD 22-01 guidance for cloud services; discontinue use if mitigations are unavailable.
• Restrict and monitor exposure of Apple devices to untrusted content and networks until patched.
• Track the KEV entry and vendor advisories for any updated guidance.

Detection

• Hunt for exploitation indicators tied to chained iOS attack activity, since this flaw is a post-compromise primitive rather than a directly observable network event.
• Monitor for unexpected process crashes or memory corruption on patched and unpatched Apple devices.
• Review device telemetry for anomalous behavior consistent with control-flow integrity bypass on targeted endpoints.
• Correlate with detections for CVE-2025-31200, referenced alongside this CVE in public exploit-chain material.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.