CVE-2025-31273 - Vulnerability Details

- webkitgtk: Processing maliciously crafted web content may lead to memory corruption

Description

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

Published: 2025-07-29

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability originates from improper memory handling within the WebKitGTK engine when it processes specially crafted web content, causing a buffer overflow (CWE‑119). This memory corruption can potentially compromise the confidentiality, integrity, or availability of the system or application by allowing an attacker to tamper with execution flow or corrupt data.

Affected Systems

Apple’s Safari browser as well as the WebKit engine embedded in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The flaw is fixed in Safari 18.6, iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6. All earlier versions without the update remain vulnerable.

Risk and Exploitability

With a CVSS score of 8.8 the flaw is considered high severity, yet the EPSS score of < 1 % indicates a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is delivering maliciously crafted web content to a user’s browser; no additional user action beyond normal web browsing is required. If successfully exploited, memory corruption could potentially allow an attacker to gain full control over the device or application context.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

Safari

affected

Version	Status	Constraints
`0`	affected	< 18.6

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.6

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 15.6

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 18.6

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 2.6

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 11.6

Configuration 1 [-]

OR	cpe:2.3:a:apple:safari::::::::
	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:visionos::::::::
	cpe:2.3:o:apple:watchos::::::::

No data.

Vendor	Product	Confidence	Versions
Apple	Ios	—	—
Apple	Ipados	—	—
Apple	Macos	—	—
Apple	Macos Sequoia	—	—
Apple	Tvos	—	—
Apple	Visionos	—	—
Apple	Watchos	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade all browsers and operating systems to the patched versions: Safari 18.6, iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6.
Configure your browsing environment to block or limit untrusted web content, such as enabling safe browsing or content filtering, to reduce exposure while updates are pending.
Set your devices to automatically download and install security updates to ensure timely protection against this and future vulnerabilities.

Generated by OpenCVE AI on April 28, 2026 at 22:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4276-1	webkit2gtk security update
Debian DSA	DSA-5978-1	webkit2gtk security update
EUVD	EUVD-2025-23087	The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, macOS Sequoia 15.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web content may lead to memory corruption.
Ubuntu USN	USN-7702-1	WebKitGTK vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00157.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
http://seclists.org/fulldisclosure/2025/Aug/0
http://seclists.org/fulldisclosure/2025/Jul/30
http://seclists.org/fulldisclosure/2025/Jul/32
http://seclists.org/fulldisclosure/2025/Jul/36
http://www.openwall.com/lists/oss-security/2025/08/02/1
https://lists.debian.org/debian-lts-announce/2025/08/msg00015.html
https://nvd.nist.gov/vuln/detail/CVE-2025-31273
https://support.apple.com/en-us/124147
https://support.apple.com/en-us/124149
https://support.apple.com/en-us/124152
https://support.apple.com/en-us/124153
https://support.apple.com/en-us/124154
https://support.apple.com/en-us/124155
https://webkitgtk.org/security/WSA-2025-0005.html
https://www.cve.org/CVERecord?id=CVE-2025-31273

History

Thu, 02 Apr 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, macOS Sequoia 15.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web content may lead to memory corruption.	The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

Tue, 04 Nov 2025 22:30:00 +0000

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2025/08/02/1

Mon, 03 Nov 2025 20:30:00 +0000

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2025/Aug/0 http://seclists.org/fulldisclosure/2025/Jul/30 http://seclists.org/fulldisclosure/2025/Jul/32 http://seclists.org/fulldisclosure/2025/Jul/36

Mon, 03 Nov 2025 19:30:00 +0000

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2025/08/msg00015.html

Tue, 05 Aug 2025 00:15:00 +0000

Type	Values Removed	Values Added
Title		webkitgtk: Processing maliciously crafted web content may lead to memory corruption
References		https://nvd.nist.gov/vuln/detail/CVE-2025-31273 https://webkitgtk.org/security/WSA-2025-0005.html https://www.cve.org/CVERecord?id=CVE-2025-31273
Metrics	threat_severity `None`	threat_severity `Important`

Thu, 31 Jul 2025 21:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple iphone Os Apple safari
CPEs		cpe:2.3:a:apple:safari:::::::: cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:tvos:::::::: cpe:2.3:o:apple:visionos:::::::: cpe:2.3:o:apple:watchos::::::::
Vendors & Products		Apple iphone Os Apple safari

Thu, 31 Jul 2025 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 30 Jul 2025 23:00:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web content may lead to memory corruption.	The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, macOS Sequoia 15.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web content may lead to memory corruption.
References		https://support.apple.com/en-us/124152

Wed, 30 Jul 2025 11:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios Apple ipados Apple macos Apple macos Sequoia Apple tvos Apple visionos Apple watchos
Vendors & Products		Apple Apple ios Apple ipados Apple macos Apple macos Sequoia Apple tvos Apple visionos Apple watchos

Wed, 30 Jul 2025 00:15:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, macOS Sequoia 15.6, visionOS 2.6. Processing maliciously crafted web content may lead to memory corruption.	The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web content may lead to memory corruption.

Tue, 29 Jul 2025 23:45:00 +0000

Type	Values Removed	Values Added
Description		The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, macOS Sequoia 15.6, visionOS 2.6. Processing maliciously crafted web content may lead to memory corruption.
References		https://support.apple.com/en-us/124147 https://support.apple.com/en-us/124149 https://support.apple.com/en-us/124153 https://support.apple.com/en-us/124154 https://support.apple.com/en-us/124155

Subscriptions

Apple Ios Ipados Iphone Os Macos Macos Sequoia Safari Tvos Visionos Watchos

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2025-07-29T23:29:17.520Z

Updated: 2026-04-02T18:15:17.036Z

Reserved: 2025-03-27T16:13:58.343Z

Link: CVE-2025-31273

Vulnrichment

Updated: 2025-11-04T21:10:02.965Z

NVD

Status : Modified

Published: 2025-07-30T00:15:30.503

Modified: 2026-04-02T19:19:59.127

Link: CVE-2025-31273

Redhat

Severity : Important

Publid Date: 2025-08-01T00:00:00Z

Links: CVE-2025-31273 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-28T22:45:25Z

Weaknesses

CWE-119

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object