CVE-2025-31200
CRITICAL KEVApple macOS < 15.4.1 - Memory Corruption via Malicious Audio Stream
Title source: llmExploitation Summary
CVE-2025-31200 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added April 17, 2025. EIP tracks 4 public exploits from researchers including JGoyd, zhuowei, hunters-sec.
AI-analyzed exploit summary This repository documents a zero-click remote exploit chain affecting iOS 18.x, involving heap corruption in CoreAudio (CVE-2025-31200) and kernel privilege escalation via AppleBCMWLAN (CVE-2025-31201). The attack is delivered via a malformed MP4 audio file through iMessage, leading to kernel-level compromise and unauthorized signing operations.
Description
A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.
Exploits (4)
This repository documents a zero-click remote exploit chain affecting iOS 18.x, involving heap corruption in CoreAudio (CVE-2025-31200) and kernel privilege escalation via AppleBCMWLAN (CVE-2025-31201). The attack is delivered via a malformed MP4 audio file through iMessage, leading to kernel-level compromise and unauthorized signing operations.
This PoC demonstrates an out-of-bounds read/write vulnerability in Apple's CoreAudio (CVE-2025-31200) by manipulating the mRemappingArray in APAC (Apple Positional Audio Codec) decoding, leading to memory corruption. The exploit requires building on macOS < 15.4.1 and uses LLDB hooks to trigger the vulnerability during audio playback.
This repository contains a Python-based PoC for CVE-2025-31200, a buffer overflow in Apple's CoreAudio APAC decoder. The exploit generates a malicious APAC cookie with mismatched channel counts to trigger out-of-bounds memory access.
This repository documents CVE-2025-31200, a zero-click RCE vulnerability in iOS 18.X's AudioConverterService, triggered via malicious audio files in iMessage/SMS. It includes a technical write-up but no exploit code.
References (15)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H