CVE-2025-31277 is a memory corruption vulnerability in Apple Safari caused by processing maliciously crafted web content. It is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The vulnerability affects Safari and related Apple operating systems prior to version 18.6 (and corresponding OS versions). Apple fixed the issue by improving memory handling in Safari 18.6, iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability may allow an attacker to cause memory corruption, potentially leading to arbitrary code execution or denial of service. The impact affects confidentiality, integrity, and availability of the affected systems. There are no known exploits in the wild currently.

This vulnerability is fixed in Safari 18.6 and the corresponding Apple operating system updates (iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6). Users and administrators should apply these official updates to remediate the issue. No additional mitigation steps are indicated by the vendor.