CVE-2025-31201

CVE-2025-31201 is a vulnerability in Apple's iOS, iPadOS, macOS Sequoia, tvOS, and visionOS that allows an attacker who has already gained arbitrary read and write capability on a device to bypass Pointer Authentication (CWE-1220), Apple's hardware-backed mitigation that normally prevents forged code execution on Apple silicon. It is not an entry-point flaw on its own; public references and news coverage show it being used as the second stage of an attack chain alongside the WebKit flaw CVE-2025-31200, which is what makes the network-reachable CVSS 3.1 score of 9.8 (critical) meaningful. By defeating Pointer Authentication, the attacker converts memory read/write primitives into the ability to run forged or unsigned code with elevated effectiveness, enabling full device compromise when chained. Any user of an iPhone, iPad, Mac (Sequoia), Apple TV, or Vision Pro running a version earlier than the fixed releases is potentially affected. Apple patched the issue by removing the vulnerable code in iOS 18.4.1/iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, and visionOS 2.4.1, and reports it was exploited in an 'extremely sophisticated' targeted attack against specific individuals on iOS; the CVE was added to CISA KEV on 2025-04-17.

What to do: Upgrade iPhones and iPads to iOS/iPadOS 18.4.1 or later, Macs on macOS Sequoia to 15.4.1 or later, Apple TVs to tvOS 18.4.1 or later, and Vision Pro units to visionOS 2.4.1 or later; the fix removed the vulnerable code, so there is no configuration workaround. Because this flaw is exploited as part of a chain with the WebKit zero-day CVE-2025-31200, patching both (they ship in the same releases) is essential, and organizations should hunt for indicators of compromise on high-value/targeted users. Federal agencies must apply the vendor fixes per CISA BOD 22-01 guidance (KEV deadline applies; added 2025-04-17) or discontinue use of affected products.