# CVE-2025-31201: Apple Multiple Products Arbitrary Read and Write Vulnerability

Source: https://junglewise.ai/threats/cve-2025-31201-apple-multiple-products-arbitrary-read-and-write-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-04-17. Updated: 2026-05-09  
License: CC BY 4.0 with a link back

CVE-2025-31201 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-04-17

Apple iOS, iPadOS, macOS, tvOS, and visionOS contain a vulnerability that allows an attacker with arbitrary read and write capabilities to bypass Pointer Authentication. The issue was addressed by removing the vulnerable code in various OS updates. Apple has received reports that this vulnerability may have been exploited in targeted attacks against iOS users.

Technologies: [Apple Multiple Products](https://junglewise.ai/threats/technologies/multiple-products). Vendors: [Apple](https://junglewise.ai/threats/vendors/apple).

## Quick answers

**Is CVE-2025-31201 exploited in the wild?** Yes. CVE-2025-31201 is known to be exploited in the wild, first recorded on 17 April 2025. Treat it as urgent.

**How severe is CVE-2025-31201?** Critical severity, with a CVSS score of 9.8, published 17 April 2025.

**Which products and versions are affected?** Apple iOS before 18.4.1; Apple iPadOS before 18.4.1; Apple macOS Sequoia before 15.4.1; Apple tvOS before 18.4.1; and 1 more.

**Is there a fix for CVE-2025-31201?** A patch was published on 2025-04-17: Fixed in iOS 18.4.1, iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, and visionOS 2.4.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-31201 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-31201?** Check whether you run Apple Multiple Products. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Apple iOS before 18.4.1
- Apple iPadOS before 18.4.1
- Apple macOS Sequoia before 15.4.1
- Apple tvOS before 18.4.1
- Apple visionOS before 2.4.1

## Timeline

- 2025-04-17: disclosed
- 2025-04-17: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2025-04-17: patched: Fixed in iOS 18.4.1, iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, and visionOS 2.4.1
- exploited: Apple is aware of reports of exploitation in sophisticated attacks against targeted individuals.

## Related threats

- [Apple iOS, iPadOS, macOS, Safari, tvOS, watchOS pointer authentication bypass](https://junglewise.ai/threats/cve-2024-27834-apple-multiple-products-improper-authentication-vulnerability)
- [Apple CoreGraphics out-of-bounds write in file processing](https://junglewise.ai/threats/cve-2026-86950-an-out-of-bounds-write-issue-was-addressed-with-improved-bounds)
- [Apple Multiple Products integer overflow in WebKit content processing](https://junglewise.ai/threats/cve-2021-30952-apple-multiple-products-integer-overflow-in-webkit-content)
- [Hikvision IP Cameras improper authentication](https://junglewise.ai/threats/cve-2017-7921-hikvision-ip-cameras-improper-authentication)
- [Rockwell Automation Logix Designer authentication bypass in Logix Controllers](https://junglewise.ai/threats/cve-2021-22681-rockwell-automation-logix-designer-authentication-bypass-in-logix)