CVE-2025-31277: Apple WebKit memory corruption via malicious web content

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 8.8 with network reachability and high confidentiality, integrity and availability impact, plus confirmed inclusion in CISA KEV indicating known exploitation, though it requires user interaction and EPSS probability is low.

What it is

Apple WebKit fails to handle memory correctly when processing crafted web content, leading to memory corruption across Safari, iOS, iPadOS, macOS, tvOS, visionOS and watchOS, with fixes in the 18.6/15.6/2.6/11.6 releases. WebKitGTK, WPE WebKit and Red Hat Enterprise Linux packages are also listed as affected. The flaw is remotely reachable and requires only that a victim load attacker-controlled web content.

Impact

An attacker can corrupt memory in the rendering process, which in a browser or WebKit-based context can be leveraged toward code execution in the victim's user context. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached over the network (AV:N) with no privileges required (PR:N), but user interaction is required (UI:R) because the victim must process the maliciously crafted web content. No authentication is needed; the entry point is web content rendering in the affected browsers and WebKit-based products.

Exploitation

CVE-2025-31277 is listed in CISA KEV with a due date of 2026-04-03, indicating known exploitation in the wild; EPSS 30-day probability is 0.01534 (73.5th percentile). A Google Threat Intelligence reference describes a DarkSword iOS exploit chain, and no ransomware campaign use is recorded.

What to do

• Update to the fixed releases: Safari 18.6, iOS/iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6, and apply the corresponding WebKitGTK, WPE WebKit and Red Hat errata.
• Prioritize patching internet-facing and user-facing Apple devices and any Linux systems shipping WebKitGTK or WPE WebKit, per CISA KEV required action and BOD 22-01 guidance.
• If patching cannot be completed immediately, restrict browsing of untrusted web content and consider disabling or removing the affected WebKit-based component where operationally feasible.
• Track the KEV remediation due date of 2026-04-03 and confirm all affected product families, including Red Hat Enterprise Linux variants, are covered.
• Verify update deployment through device management or package management reporting rather than relying on user-initiated updates.

Detection

• Monitor for crashes or abnormal termination of WebKit rendering processes (Safari, WebKitGTK, WPE WebKit) on endpoints, especially following visits to untrusted sites.
• Hunt for exploit-chain indicators associated with the referenced DarkSword iOS exploit chain in mobile device telemetry and network logs.
• Review proxy, DNS and browser telemetry for access to known malicious or exploit-hosting domains that deliver crafted web content.
• Audit asset inventories for unpatched Safari, iOS/iPadOS, macOS, tvOS, visionOS, watchOS, WebKitGTK, WPE WebKit and Red Hat Enterprise Linux systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.