CVE-2025-31276

MEDIUM

iPadOS < 17.7.9 and < 18.6 - Unauthorized Remote Content Loading via Load Remote Images Setting Bypass

Title source: llm
STIX 2.1

Description

This issue was addressed through improved state management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Remote content may be loaded even when the 'Load Remote Images' setting is turned off.

References (3)

Core 3
Core References
Release Notes, Vendor Advisory
https://support.apple.com/en-us/124147
Release Notes, Vendor Advisory
https://support.apple.com/en-us/124148

Scores

CVSS v3 5.3
EPSS 0.0037
EPSS Percentile 29.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-359
Status published
Products (4)
Apple/iOS and iPadOS < 18.6
apple/ipados < 17.7.9
Apple/iPadOS < 17.7.9
apple/iphone_os < 18.6
Published Jul 30, 2025
Tracked Since Feb 18, 2026