Apple iPadOS vulnerabilities

CVE-2025-31213 [HIGH] CWE-532 CVE-2025-31213: A logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.7, ma A logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to access associated usernames and websites in a user's iCloud Keychain.

CVE-2025-31253 [HIGH] CWE-672 CVE-2025-31253: This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPad This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. Muting the microphone during a FaceTime call may not result in audio being silenced.

CVE-2025-31207 [HIGH] CWE-200 CVE-2025-31207: A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. A A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. An app may be able to enumerate a user's installed apps.

CVE-2025-31238 [HIGH] CWE-119 CVE-2025-31238: The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadO The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.

CVE-2025-31221 [HIGH] CWE-190 CVE-2025-31221: An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.5 an An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. A remote attacker may be able to leak memory.

CVE-2025-31222 [HIGH] CWE-269 CVE-2025-31222: A correctness issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 1 A correctness issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. A user may be able to elevate privileges.

CVE-2025-31234 [HIGH] CWE-119 CVE-2025-31234: The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5. An attacker may be able to cause unexpected system termination or corrupt kernel memory.

CVE-2024-8176 [HIGH] CVE-2024-8176: iPadOS 17.7.7 Apple Security Update: About the security content of iPadOS 17.7.7 Product: iPadOS Version: 17.7.7 CVE: CVE-2024-8176 Component: CVE-2024-8176

CVE-2025-24144 [MEDIUM] CWE-200 CVE-2025-24144: An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed i An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.7, macOS Sequoia 15.3, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.3, visionOS 2.3, watchOS 11.3. An app may be able to leak sensitive kernel state.

CVE-2025-24225 [MEDIUM] CWE-79 CVE-2025-24225: An injection issue was addressed with improved input validation. This issue is fixed in iOS 18.5 and An injection issue was addressed with improved input validation. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. Processing an email may lead to user interface spoofing.

CVE-2025-24220 [MEDIUM] CWE-200 CVE-2025-24220: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.4 and A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.9. An app may be able to read a persistent device identifier.

CVE-2025-31239 [MEDIUM] CWE-416 CVE-2025-31239: A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18. A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Parsing a file may lead to an unexpected app termination.

CVE-2025-31215 [MEDIUM] CWE-20 CVE-2025-31215: The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadO The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2025-31228 [MEDIUM] CWE-287 CVE-2025-31228: The issue was addressed with improved authentication. This issue is fixed in iOS 18.5 and iPadOS 18. The issue was addressed with improved authentication. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. An attacker with physical access to a device may be able to access notes from the lock screen.

CVE-2025-31235 [MEDIUM] CWE-415 CVE-2025-31235: A double free issue was addressed with improved memory management. This issue is fixed in iPadOS 17. A double free issue was addressed with improved memory management. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to cause unexpected system termination.

CVE-2025-24111 [MEDIUM] CWE-119 CVE-2025-24111: A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 1 A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.7, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. An app may be able to cause unexpected system termination.

CVE-2025-31227 [MEDIUM] CWE-863 CVE-2025-31227: A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. A A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. An attacker with physical access to a device may be able to access a deleted call recording.

CVE-2025-31209 [MEDIUM] CWE-125 CVE-2025-31209: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 a An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Parsing a file may lead to disclosure of user information.

CVE-2025-31205 [MEDIUM] CWE-352 CVE-2025-31205: The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadO The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. A malicious website may exfiltrate data cross-origin.

CVE-2025-31226 [MEDIUM] CWE-400 CVE-2025-31226: A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, i A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing a maliciously crafted image may lead to a denial-of-service.