CVE-2025-31277: high-severity vulnerability in Apple Safari
Published · Updated
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A flaw in Safari and Apple devices allows attackers to corrupt memory by sending maliciously crafted web content. This can crash your browser or potentially enable further attacks on your device.
Buffer overflow or out-of-bounds memory access vulnerability (CWE-119) in Safari's web content processing engine. Remote attack vector via malicious web content; no user interaction beyond visiting a crafted webpage required. Successful exploitation leads to memory corruption, enabling code execution or denial of service.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.