CVE-2025-31227: Use After Free
First published: Mon May 12 2025(Updated: )
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. An attacker with physical access to a device may be able to access a deleted call recording.
Credit: Hossein Lotfi @hosselot Trend Micro Zero Day InitiativeDalibor Milanovic Andrew James Gonzalez YingQi Shi @Mas0nShi DBAppSecurity's WeBin labDuy Trần @khanhduytran0 Dayton Pidhirney Atredis PartnersLyutoon YenKoc Saagar Jha Michael DePlante @izobashi Trend Micro Zero Day InitiativeLucas Leong @_wmliang_ Trend Micro Zero Day InitiativeChristian Kohlschütter CVE-2024-8176 Richard Hyunho Im @richeeta Paweł Płatek (Trail BitsAndr.Ess Shehab Khan wac CertiK @CertiK Dave G. Google V8 Security Team Andreas Jaegersberger & Ro Achterberg Nosebeard Labswac Trend Micro Zero Day Initiativerheza @ginggilBesel an anonymous researcher Nan Wang @eternalsakura13 Ignacio Sanmillan @ulexec Jiming Wang Jikai Ren Ivan Fratric Google Project ZeroJuergen Schmied Lynck GmbH秦若涵 崔志伟 崔宝江 Deval Jariwala Guilherme Rambo Best Buddy Apps
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple iOS and iPadOS | <18.5 | 18.5 |
| Apple iOS, iPadOS, and macOS | <18.5 | 18.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://support.apple.com/en-us/122404 (Advisory)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2025-31251
- CVE-2025-31214
- CVE-2025-31225
- CVE-2025-31212
- CVE-2025-31208
- CVE-2025-31209
- CVE-2025-31239
- CVE-2025-31233
- CVE-2025-31253
- CVE-2025-31210
- CVE-2025-31207
- CVE-2025-30448
- CVE-2025-31226
- CVE-2025-31219
- CVE-2025-31241
- CVE-2024-8176
- CVE-2025-24225
- CVE-2025-31222
- CVE-2025-31228
- CVE-2025-31227
- CVE-2025-31245
- CVE-2025-31234
- CVE-2025-31221
- CVE-2025-24213
- CVE-2025-31223
- CVE-2025-31238
- CVE-2025-24223
- CVE-2025-31204
- CVE-2025-31217
- CVE-2025-31215
- CVE-2025-31206
- CVE-2025-31205
- CVE-2025-31257
Frequently Asked Questions
What is the severity of CVE-2025-31227?
CVE-2025-31227 is classified as a high-severity vulnerability due to the potential for data exposure and unauthorized access.
How do I fix CVE-2025-31227?
To fix CVE-2025-31227, users should update their devices to the latest version of iOS or iPadOS, specifically version 18.5 or later.
What products are affected by CVE-2025-31227?
CVE-2025-31227 affects Apple iOS and iPadOS versions prior to 18.5.
What types of issues does CVE-2025-31227 address?
CVE-2025-31227 addresses issues related to input sanitization, state management, and privacy concerns involving sensitive data.
Is there a permanent fix for CVE-2025-31227?
Yes, the permanent fix for CVE-2025-31227 is to ensure your device runs on iOS or iPadOS version 18.5 or later.
- collector/apple-support
- source/Apple
- alias/CVE-2025-31253
- alias/CVE-2025-31210
- alias/CVE-2025-31207
- alias/CVE-2025-30448
- alias/CVE-2025-31226
- alias/CVE-2025-31219
- alias/CVE-2025-31241
- alias/CVE-2024-8176
- alias/CVE-2025-24225
- alias/CVE-2025-31222
- alias/CVE-2025-31228
- alias/CVE-2025-31227
- alias/CVE-2025-31245
- alias/CVE-2025-31234
- alias/CVE-2025-31221
- alias/CVE-2025-24213
- alias/CVE-2025-31223
- alias/CVE-2025-31238
- alias/CVE-2025-24223
- alias/CVE-2025-31204
- alias/CVE-2025-31217
- alias/CVE-2025-31215
- alias/CVE-2025-31206
- alias/CVE-2025-31205
- alias/CVE-2025-31257
- agent/software-canonical-lookup
- alias/CVE-2025-31233
- alias/CVE-2025-31239
- alias/CVE-2025-31225
- alias/CVE-2025-31212
- alias/CVE-2025-31208
- alias/CVE-2025-31209
- alias/CVE-2025-31214
- agent/weakness
- agent/softwarecombine
- agent/references
- agent/first-publish-date
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- agent/description
- agent/type
- agent/event
- vendor/apple
- canonical/apple ios and ipados
- canonical/apple ios, ipados, and macos