site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-05-12-2025-1 iOS 18.5 and iPadOS 18.5 iOS 18.5 and iPadOS 18.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/122404. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. AppleJPEG Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: The issue was addressed with improved input sanitization. CVE-2025-31251: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative Baseband Available for: iPhone 16e Impact: An attacker in a privileged network position may be able to intercept network traffic Description: This issue was addressed through improved state management. CVE-2025-31214: 秦若涵, 崔志伟, and 崔宝江 Call History Available for: iPhone XS and later Impact: Call history from deleted apps may still appear in spotlight search results Description: A privacy issue was addressed by removing sensitive data. CVE-2025-31225: Deval Jariwala Core Bluetooth Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: This issue was addressed through improved state management. CVE-2025-31212: Guilherme Rambo of Best Buddy Apps (rambo.codes) CoreAudio Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Parsing a file may lead to an unexpected app termination Description: The issue was addressed with improved checks. CVE-2025-31208: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CoreGraphics Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Parsing a file may lead to disclosure of user information Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2025-31209: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CoreMedia Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Parsing a file may lead to an unexpected app termination Description: A use-after-free issue was addressed with improved memory management. CVE-2025-31239: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CoreMedia Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory Description: The issue was addressed with improved input sanitization. CVE-2025-31233: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative FaceTime Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Muting the microphone during a FaceTime call may not result in audio being silenced Description: This issue was addressed through improved state management. CVE-2025-31253: Dalibor Milanovic FaceTime Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Processing web content may lead to a denial-of-service Description: The issue was addressed with improved UI. CVE-2025-31210: Andrew James Gonzalez FrontBoard Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: An app may be able to enumerate a user's installed apps Description: A logic issue was addressed with improved checks. CVE-2025-31207: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab, Duy Trần (@khanhduytran0) iCloud Document Sharing Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: An attacker may be able to turn on sharing of an iCloud folder without authentication Description: This issue was addressed with additional entitlement checks. CVE-2025-30448: Dayton Pidhirney of Atredis Partners, Lyutoon and YenKoc ImageIO Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted image may lead to a denial-of- service Description: A logic issue was addressed with improved checks. CVE-2025-31226: Saagar Jha Kernel Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: An attacker may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2025-31219: Michael DePlante (@izobashi) and Lucas Leong (@_wmliang_) of Trend Micro Zero Day Initiative Kernel Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: A remote attacker may cause an unexpected app termination Description: A double free issue was addressed with improved memory management. CVE-2025-31241: Christian Kohlschütter libexpat Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Multiple issues in libexpat, including unexpected app termination or arbitrary code execution Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2024-8176 Mail Addressing Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Processing an email may lead to user interface spoofing Description: An injection issue was addressed with improved input validation. CVE-2025-24225: Richard Hyunho Im (@richeeta) mDNSResponder Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: A user may be able to elevate privileges Description: A correctness issue was addressed with improved checks. CVE-2025-31222: Paweł Płatek (Trail of Bits) Notes Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: An attacker with physical access to a device may be able to access notes from the lock screen Description: The issue was addressed with improved authentication. CVE-2025-31228: Andr.Ess Notes Available for: iPhone XS and later Impact: An attacker with physical access to a device may be able to access a deleted call recording Description: A logic issue was addressed with improved checks. CVE-2025-31227: Shehab Khan Pro Res Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: The issue was addressed with improved checks. CVE-2025-31245: wac Pro Res Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: An attacker may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved input sanitization. CVE-2025-31234: CertiK (@CertiK) Security Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: A remote attacker may be able to leak memory Description: An integer overflow was addressed with improved input validation. CVE-2025-31221: Dave G. WebKit Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: A type confusion issue could lead to memory corruption Description: This issue was addressed with improved handling of floats. WebKit Bugzilla: 286694 CVE-2025-24213: Google V8 Security Team WebKit Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved checks. WebKit Bugzilla: 289387 CVE-2025-31223: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs WebKit Bugzilla: 289653 CVE-2025-31238: wac working with Trend Micro Zero Day Initiative WebKit Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 287577 CVE-2025-24223: rheza (@ginggilBesel) and an anonymous researcher WebKit Bugzilla: 291506 CVE-2025-31204: Nan Wang(@eternalsakura13) WebKit Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved input validation. WebKit Bugzilla: 289677 CVE-2025-31217: Ignacio Sanmillan (@ulexec) WebKit Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: The issue was addressed with improved checks. WebKit Bugzilla: 288814 CVE-2025-31215: Jiming Wang and Jikai Ren WebKit Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A type confusion issue was addressed with improved state handling. WebKit Bugzilla: 290834 CVE-2025-31206: an anonymous researcher WebKit Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: A malicious website may exfiltrate data cross-origin Description: The issue was addressed with improved checks. WebKit Bugzilla: 290992 CVE-2025-31205: Ivan Fratric of Google Project Zero WebKit Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: This issue was addressed with improved memory handling. WebKit Bugzilla: 290985 CVE-2025-31257: Juergen Schmied of Lynck GmbH Additional recognition AirDrop We would like to acknowledge Dalibor Milanovic for their assistance. Kernel We would like to acknowledge an anonymous researcher for their assistance. libnetcore We would like to acknowledge Hoffcona of ByteDance IES Red Team for their assistance. Messages We would like to acknowledge Paulo Henrique Batista Rosa de Castro (@paulohbrc) for their assistance. MobileGestalt We would like to acknowledge iisBuri for their assistance. MobileLockdown We would like to acknowledge Matthias Frielingsdorf (@helthydriver) of iVerify, an anonymous researcher for their assistance. NetworkExtension We would like to acknowledge Andrei-Alexandru Bleorțu for their assistance. Phone We would like to acknowledge Abhay Kailasia (@abhay_kailasia) from C-DAC Thiruvananthapuram India for their assistance. Photos We would like to acknowledge Yusuf Kelany for their assistance. Safari We would like to acknowledge Akash Labade, Narendra Bhati, Manager of Cyber Security at Suma Soft Pvt. Ltd, Pune (India) for their assistance. Screenshots We would like to acknowledge an anonymous researcher for their assistance. Shortcuts We would like to acknowledge Candace Jensen of Kandji, Chi Yuan Chang of ZUSO ART and taikosoup, Egor Filatov (Positive Technologies), Monnier Pascaud for their assistance. Siri Suggestions We would like to acknowledge Jake Derouin (jakederouin.com) for their assistance. Spotlight We would like to acknowledge Abhay Kailasia (@abhay_kailasia) from C-DAC Thiruvananthapuram India for their assistance. WebKit We would like to acknowledge Mike Dougherty and Daniel White of Google Chrome and an anonymous researcher for their assistance. This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 18.5 and iPadOS 18.5". All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmgicfoACgkQX+5d1TXa IvrQXg/8DugMW7AvuWQ51DNjkLIM+eCNl0IZzUoQc2HFR+i6ZzjfnG/aVkP7eV5r KLy07xO1i+w+csIFClFg/Ir3EaWlm8AhqRw03bRGpPT+a7ef1i1uQ5FfWKMGDsi7 5GMPUQ4bwFUnago+okDxGLTxA5InSVzbzNVsbU2MzTolxlos34vZJsUoQmxn2F7O uQOa8YZX36n/xyTiD/trE2RZbANU+G44OCCZIaGA7hXkF09bN3nsJrBN6fu8KCfO YBtrkcG3y0A9cliteJOnIoK2MQwsVfGdkQuEyIsCidBsGarZBDLz/oZV13aB8vvu wcqmL/1lGFvl0HVxN/dMFFaKT/GNWkZwHx0N/J7P9Xx3IkwjYuqA8hCYikODE7HB 0cGqDudTN/BSUKUiYPifTceaduFM9uXZaKqsmPsegmAVnil2n7isT+oU2T7EnPT9 rK9vNZTAN/aWEap6e1HZn940Do3enpzfqakQyw76Lnd9DMlytUSJoT1fD+u1HM2a eeY7r4yb4M7s6HiDqdr4SDv3bKyzl3wID4I+mANfc8pHsXDvKiNQtZ2KAYF3Vgve VXkseu2PU6MwqPa9l5vP+R2aBrIOwOWYmP0u2BfAuDvvw4OZQfTvoLtkhgYx0M5a +302xLJxAOXy+6ESQSib0QVCbjYaqCHBc9j9ylVNUrSDGkhcUCc= =LLOm -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com