site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-05-12-2025-6 watchOS 11.5 watchOS 11.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/122722. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. AppleJPEG Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: The issue was addressed with improved input sanitization. CVE-2025-31251: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative Core Bluetooth Available for: Apple Watch Series 6 and later Impact: An app may be able to access sensitive user data Description: This issue was addressed through improved state management. CVE-2025-31212: Guilherme Rambo of Best Buddy Apps (rambo.codes) CoreAudio Available for: Apple Watch Series 6 and later Impact: Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1. Description: A memory corruption issue was addressed with improved bounds checking. CVE-2025-31200: Apple and Google Threat Analysis Group CoreAudio Available for: Apple Watch Series 6 and later Impact: Parsing a file may lead to an unexpected app termination Description: The issue was addressed with improved checks. CVE-2025-31208: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CoreGraphics Available for: Apple Watch Series 6 and later Impact: Parsing a file may lead to disclosure of user information Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2025-31209: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CoreMedia Available for: Apple Watch Series 6 and later Impact: Parsing a file may lead to an unexpected app termination Description: A use-after-free issue was addressed with improved memory management. CVE-2025-31239: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CoreMedia Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory Description: The issue was addressed with improved input sanitization. CVE-2025-31233: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative ImageIO Available for: Apple Watch Series 6 and later Impact: Processing a maliciously crafted image may lead to a denial-of- service Description: A logic issue was addressed with improved checks. CVE-2025-31226: Saagar Jha Kernel Available for: Apple Watch Series 6 and later Impact: An attacker may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2025-31219: Michael DePlante (@izobashi) and Lucas Leong (@_wmliang_) of Trend Micro Zero Day Initiative Kernel Available for: Apple Watch Series 6 and later Impact: A remote attacker may cause an unexpected app termination Description: A double free issue was addressed with improved memory management. CVE-2025-31241: Christian Kohlschütter libexpat Available for: Apple Watch Series 6 and later Impact: Multiple issues in libexpat, including unexpected app termination or arbitrary code execution Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2024-8176 mDNSResponder Available for: Apple Watch Series 6 and later Impact: A user may be able to elevate privileges Description: A correctness issue was addressed with improved checks. CVE-2025-31222: Paweł Płatek (Trail of Bits) Security Available for: Apple Watch Series 6 and later Impact: A remote attacker may be able to leak memory Description: An integer overflow was addressed with improved input validation. CVE-2025-31221: Dave G. WebKit Available for: Apple Watch Series 6 and later Impact: A type confusion issue could lead to memory corruption Description: This issue was addressed with improved handling of floats. WebKit Bugzilla: 286694 CVE-2025-24213: Google V8 Security Team WebKit Available for: Apple Watch Series 6 and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved checks. WebKit Bugzilla: 289387 CVE-2025-31223: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs WebKit Bugzilla: 289653 CVE-2025-31238: wac working with Trend Micro Zero Day Initiative WebKit Available for: Apple Watch Series 6 and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 287577 CVE-2025-24223: rheza (@ginggilBesel) and an anonymous researcher WebKit Bugzilla: 291506 CVE-2025-31204: Nan Wang(@eternalsakura13) WebKit Available for: Apple Watch Series 6 and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved input validation. WebKit Bugzilla: 289677 CVE-2025-31217: Ignacio Sanmillan (@ulexec) WebKit Available for: Apple Watch Series 6 and later Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved checks. WebKit Bugzilla: 288814 CVE-2025-31215: Jiming Wang and Jikai Ren WebKit Available for: Apple Watch Series 6 and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A type confusion issue was addressed with improved state handling. WebKit Bugzilla: 290834 CVE-2025-31206: an anonymous researcher WebKit Available for: Apple Watch Series 6 and later Impact: A malicious website may exfiltrate data cross-origin Description: The issue was addressed with improved checks. WebKit Bugzilla: 290992 CVE-2025-31205: Ivan Fratric of Google Project Zero WebKit Available for: Apple Watch Series 6 and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: This issue was addressed with improved memory handling. WebKit Bugzilla: 290985 CVE-2025-31257: Juergen Schmied of Lynck GmbH Additional recognition AirDrop We would like to acknowledge Dalibor Milanovic for their assistance. Kernel We would like to acknowledge an anonymous researcher for their assistance. MobileGestalt We would like to acknowledge iisBuri for their assistance. NetworkExtension We would like to acknowledge Andrei-Alexandru Bleorțu for their assistance. Shortcuts We would like to acknowledge Candace Jensen of Kandji, Chi Yuan Chang of ZUSO ART and taikosoup, Egor Filatov (Positive Technologies) for their assistance. WebKit We would like to acknowledge Mike Dougherty and Daniel White of Google Chrome and an anonymous researcher for their assistance. Instructions on how to update your Apple Watch software are available at https://support.apple.com/108926 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmgicswACgkQX+5d1TXa IvqySg/+NDzjAR9a+sGzVrSWg1kTZdBINszH1YStnLBNtk2IK0c6Qd3kM+RjOaIc k1VEBeO/PJxAbOKlXIDLmzI4Wvx7FSb2SIBU865b1awGo4icOYxRs5xE96FOVEw6 7Ads4TgnpLuk5zN8cZ110mA525QujE4uxfBOSLO96OLnkYahPxj/UjtmC7tYKSHT GYUhV6nCJL7NC60yD3qRHdX4tI79Od+JcajCepYHx1HxSUzk0Tf/tdk5hRhUKf1O 9sAWJ0PFI4uUGggfTLdojd2szYEhty8y8S6VxgOOzTqBmBnB44I1o/OuZ1p9FN3C ItaPDX+ElxYQ1Zt3cTxprrimonWkcskvXUv4JsOLrsZmVxkENBYs9z3LjyTZg2H2 wLgdi/kpmTRdh0bTmJS4BUcZ5udlxtcCQR3gCNSLpbIdNcus8qnLvDibyFQSQcTP AKIXV3LlcU2GneYZgucdQtV+FhOk9Ftf4wXWcAXEz3wIKkYiMIfCthAzGBGS0sZv HfHE0Y3RJSzXzwAg/cnehepYgz8wzxGkF4SnarYlZ7cxKz1FtHdaE3FobzpRusba KQqgfSnfw6Zs+NMxLmKNO6P/d/OUxEuS2kkkO9UQLqqVvfibRSdf1TP2abT2doVb bRiMBfWg/pZBXbwB48jPYsOWCzxEpjsPNpffQVx89Qv4WgxIt0s= =r54m -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com