Vulnerability

CERT-In Vulnerability Note CIVN-2025-0085
Multiple Vulnerabilities in Apple products

Original Issue Date:April 23, 2025

Severity Rating: HIGH

Software Affected

Apple iOS and iPadOS version prior to 18.4.1
(Available for iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later)
Apple macOS Sequoia version prior to 15.4.1
Apple tvOS version prior to 18.4.1
(Available for Apple TV HD and Apple TV 4K (all models))
Apple visionOS version prior to 2.4.1
(Available for Apple Vision Pro)

Overview

Multiple vulnerabilities have been reported in Apple products which could allow an attacker to execute arbitrary code on the targeted system.

Target Audience:
Individual and organizational users of Apple iOS, iPadOS, macOS, tvOS and visionOS devices.

Risk Assessment:
Very High risk of extremely sophisticated attack or arbitrary code execution.

Impact Assessment:
Potential for sophisticated targeted attacks.

Description

Multiple vulnerabilities exist in Apple products due to memory corruption issue in the Core Audio framework and a Pointer Authentication bypass in the Remote Participant Audio Control (RPAC) framework. The Core Audio framework is a low-level API that enables interaction with the audio hardware on Apple devices, while the Remote Participant Audio Control (RPAC) framework allows apps to manage audio streams for remote participants in communication applications on Apple devices.

Successful exploitation of these vulnerabilities could enable sophisticated targeted attacks, allowing an attacker to execute arbitrary code on the targeted system.

Solution

Apply appropriate fixes as mentioned in the Apple Security Advisory:
https://support.apple.com/en-us/122282

https://support.apple.com/en-us/122400

https://support.apple.com/en-us/122401

https://support.apple.com/en-us/122402

Vendor Information

Apple
https://support.apple.com/en-us/122282
https://support.apple.com/en-us/122400
https://support.apple.com/en-us/122401
https://support.apple.com/en-us/122402

CVE Name
CVE-2025-31200
CVE-2025-31201

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India