VulnerabilityModified
CVE-2025-31206
Processing maliciously crafted web content may lead to an unexpected Safari crash.
MEDIUM 4.3EPSS 0.96%
Does this matter?
Lower severity and a low EPSS score (0.96%). Track it; it rarely justifies an emergency change on its own.
Description
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
- EPSS
- 0.96% probability · 60th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-843
- Affected
- apple/safari · apple/ipados · apple/iphone os · apple/macos · apple/tvos · apple/visionos · apple/watchos
- Source
- product-security@apple.com
References
- https://support.apple.com/en-us/122404Release Notes, Vendor Advisory
- https://support.apple.com/en-us/122405Release Notes, Vendor Advisory
- https://support.apple.com/en-us/122716Release Notes, Vendor Advisory
- https://support.apple.com/en-us/122719Release Notes, Vendor Advisory
- https://support.apple.com/en-us/122720Release Notes, Vendor Advisory
- https://support.apple.com/en-us/122721Release Notes, Vendor Advisory
- https://support.apple.com/en-us/122722Release Notes, Vendor Advisory
- http://seclists.org/fulldisclosure/2025/May/10
- http://seclists.org/fulldisclosure/2025/May/12
- http://seclists.org/fulldisclosure/2025/May/13
- http://seclists.org/fulldisclosure/2025/May/5
- http://seclists.org/fulldisclosure/2025/May/6
- http://seclists.org/fulldisclosure/2025/May/7
- https://lists.debian.org/debian-lts-announce/2025/06/msg00016.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.