CVE-2025-31202 Null dereference in iOS and iPadOS

Medium 5.5 Published 29 Apr 2025 Updated 2 Apr 2026

A local network attacker can cause a denial-of-service via null pointer dereference in Apple operating systems.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-31202?

CVE-2025-31202 is a medium-severity vulnerability in Apple Ipados, published on 29 Apr 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4. An attacker on the local network may be able to cause a denial-of-service.

Weakness: CWE-476

Which versions are affected by CVE-2025-31202?

It affects 5 products.

Products include Apple Ipados, Apple Iphone Os, Apple Macos, Apple Tvos, Apple Visionos.

How do I fix CVE-2025-31202?

No fix has been published for CVE-2025-31202 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-31202 being exploited?

There is no known exploitation of CVE-2025-31202 in the wild and no public exploit code.

All Apple Ipados vulnerabilities

Sources

Also known as GHSA-vmwg-3cwg-gccp.