CVE-2025-31253
published 2025-05-12CVE-2025-31253: This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. Muting the microphone during a FaceTime call may…
PriorityP426high7.1CVSS 3.1
AVLACLPRNUIRSUCHINAH
EPSS
0.18%
8.4th percentile
This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. Muting the microphone during a FaceTime call may not result in audio being silenced.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_18.5_and_ipados | — | — |
| apple | ios_and_ipados | < 18.5 | 18.5 |
| apple | ipados | < 18.5 | 18.5 |
| apple | iphone_os | < 18.5 | 18.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2025-31253: iOS 18.5 and iPadOS 18.5
vendor_apple·2025-05-12·CVSS 7.1
CVE-2025-31253 [HIGH] CVE-2025-31253: iOS 18.5 and iPadOS 18.5
Apple Security Update: About the security content of iOS 18.5 and iPadOS 18.5
Product: iOS 18.5 and iPadOS
Version: 18.5
CVE: CVE-2025-31253
Component: FaceTime
Impact: Muting the microphone during a FaceTime call may not result in audio being silenced
Description: This issue was addressed through improved state management.
GHSA
flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism
ghsa·2026-05-11
CVE-2026-31253 [HIGH] CWE-94 flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism
flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism
The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CWE-502) in its checkpoint loading mechanism. The load_checkpoint() function in checkpoint.py and the checkpoint loading code in eval.py use torch.load() without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a maliciously crafted checkpoint file. When a victim loads this checkpoint during model warmstarting or evaluation, arbitrary code is executed on the victim's system.
GHSA
GHSA-jg4r-7hcf-wqjr: This issue was addressed through improved state management
ghsa_unreviewed·2025-05-13
CVE-2025-31253 [HIGH] CWE-672 GHSA-jg4r-7hcf-wqjr: This issue was addressed through improved state management
This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. Muting the microphone during a FaceTime call may not result in audio being silenced.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-05-12
Published