CVE-2025-31239 Use after free in iOS and iPadOS

Medium 4.3 Published 12 May 2025 Updated 2 Apr 2026

An attacker can cause unexpected app termination by parsing a malicious file, affecting users of Apple operating systems.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-31239?

CVE-2025-31239 is a medium-severity use after free vulnerability in Apple Ipados, published on 12 May 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Parsing a file may lead to an unexpected app termination.

Weakness: CWE-416

Which versions are affected by CVE-2025-31239?

It affects 6 products.

Products include Apple Ipados, Apple Iphone Os, Apple Macos, Apple Tvos, Apple Visionos, Apple Watchos.

How do I fix CVE-2025-31239?

No fix has been published for CVE-2025-31239 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2025-31239 being exploited?

There is no known exploitation of CVE-2025-31239 in the wild and no public exploit code.

All Apple Ipados vulnerabilities

Sources

Also known as GHSA-qfr5-98gw-pmcj.