Description
A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apple | iOS and iPadOS | < 18.4.1 | 18.4.1 |
| Apple | macOS | < 15.4.1 | 15.4.1 |
| Apple | tvOS | < 18.4.1 | 18.4.1 |
| Apple | visionOS | < 2.4.1 | 2.4.1 |
| Apple | watchOS | < 11.5 | 11.5 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 4 repositories
-
JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201 ★ 210 · May 17, 2025
CVE-2025-31200 is a zero-day, zero-click RCE in iOS CoreAudio’s AudioConverterService, triggered by a malicious audio file via iMessage/SMS. Exploitation bypassed Blastdoor, enabled kernel escalation…
-
zhuowei/apple-positional-audio-codec-invalid-header ★ 115 · Apr 21, 2025
CVE-2025-31200 - @Noahhw46 figured it out
-
hunters-sec/CVE-2025-31200 ★ 12 · Aug 28, 2025
IOS audio buffer overflow CVE-2025-31200 POC
-
serundengsapi/CVE-2025-31200-iOS-AudioConverter-RCE ★ 2 · May 22, 2025
Public disclosure of CVE-2025-31200 – Zero-click RCE in iOS 18.X via AudioConverterService and malicious audio file.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- NCSC-2025-0136 Kwetsbaarheden verholpen in Apple macOS, iOS en iPadOS NCSC-NL (Netherlands) · Apr 17, 2025
- WID-SEC-2025-0846 Apple iOS, iPadOS und macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2025