---
id: CVE-2025-31200
title: Memory corruption in CoreAudio via crafted media file
summary: >-
  A maliciously crafted media file processed by Apple CoreAudio can trigger heap
  corruption leading to remote code execution. Reported as exploited in the wild
  against targeted individuals.
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe: CWE-787
vendor: Apple
product: CoreAudio
platforms:
  - iOS
  - iPadOS
  - macOS
  - tvOS
  - visionOS
affected:
  - iOS < 18.4.1
  - macOS Sequoia < 15.4.1
patched:
  - iOS 18.4.1
  - macOS Sequoia 15.4.1
exploited: true
zeroDay: true
epss: 0.18751
epssPercentile: 0.97176
kev: true
kevDateAdded: '2025-04-17'
kevDueDate: '2025-05-08'
kevRansomware: false
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-31200'
references:
  - url: 'https://support.apple.com/en-us/122282'
    label: Apple security advisory
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-31200'
    label: NVD
tags:
  - apple
  - rce
  - in-the-wild
  - media-parsing
  - kev
  - exploit-available
exploits:
  github: 4
  githubRepos:
    - 'https://github.com/zhuowei/apple-positional-audio-codec-invalid-header'
    - 'https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201'
    - 'https://github.com/serundengsapi/CVE-2025-31200-iOS-AudioConverter-RCE'
  checkedAt: '2026-09-25T08:20:34.946Z'
exploitAvailable: true
---

## Overview

A memory corruption issue exists in the **CoreAudio** media parsing path. Processing
an audio stream embedded in a maliciously crafted media file can corrupt heap memory
and, when chained, lead to arbitrary code execution in the context of the media
service.

Apple states this issue "may have been exploited in an extremely sophisticated attack
against specific targeted individuals."

## Impact

- **Remote code execution** with user interaction (open/preview of the media file).
- Affects the wide CoreAudio-backed surface: Messages, Safari preview, Mail, AirDrop
  previews, and any app that decodes audio via the system framework.

## Affected versions

| Platform | Affected | Fixed |
| --- | --- | --- |
| iOS / iPadOS | < 18.4.1 | 18.4.1 |
| macOS Sequoia | < 15.4.1 | 15.4.1 |
| tvOS | < 18.4.1 | 18.4.1 |
| visionOS | < 2.4.1 | 2.4.1 |

## Detection

No reliable host-side IOC published. Recommended signals:

- Crash logs referencing `CoreAudio` / `AudioCodecs` with `EXC_BAD_ACCESS`.
- Inbound media files from untrusted contacts immediately preceding a media-service
  crash loop.

## Remediation

1. Update to the fixed build on every affected platform immediately.
2. For high-risk users, enable **Lockdown Mode**, which constrains media auto-preview.
3. Treat unsolicited media attachments as hostile until patched.

## References

- Apple security advisory: <https://support.apple.com/en-us/122282>
- NVD: <https://nvd.nist.gov/vuln/detail/CVE-2025-31200>