Apple macOS Media File memory corruption

Summaryinfo

A vulnerability classified as critical has been found in Apple macOS. This vulnerability affects unknown code of the component Media File Handler. The manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2025-31200. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Apple macOS (version now known). It has been rated as critical. This issue affects some unknown processing of the component Media File Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A memory corruption issue was addressed with improved bounds checking. This issue is fixed in tvOS 18.4.1, visionOS 2.4.1, iOS iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.

The advisory is shared at support.apple.com. The identification of this vulnerability is CVE-2025-31200 since 03/27/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are unknown but an exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/02/2025).

It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 234506 (macOS 15.x < 15.4.1 Multiple Vulnerabilities (122400)), which helps to determine the existence of the flaw in a target environment. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 04/17/2025 with a due date of 05/08/2025:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Zero-Day.cz (990), Tenable (234506) and EUVD (EUVD-2025-11380). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Apple

Name

• macOS

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion