CVE-2025-31200

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero
Triaged: March 3, 2026 7 articles
VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24
1.77%
probability
This CVE has a 1.77% probability of being exploited in the next 30 days.
0% Top 82.9th percentile of all CVEs 100%
CVSS score unavailable
Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero
Memory Corruption in CoreAudio

Attack Intelligence

Google Project Zero

Patched
April 16, 2025
Reported by
Apple and Google Threat Analysis Group

Exploits & PoC

zhuowei/apple-positional-audio-codec-invalid-header

CVE-2025-31200 - @Noahhw46 figured it out

119
hunters-sec/CVE-2025-31200

IOS audio buffer overflow CVE-2025-31200 POC

11
2 repos — triés par ⭐ Rechercher sur GitHub ↗

Signal Intelligence

Confidenceⓘ
95%
EPSS 1.77%
Mentions 7
Last Seen Dec 13, 2025

CNA Information

Analyst Note

CVE-2025-31200 is confirmed as a critical zero-day (CVSS 9.8) exploited in sophisticated targeted attacks against specific users, with reports from Google Project Zero and multiple reputable security sources including BleepingComputer. Apple has issued patches across multiple platforms (visionOS, tvOS, iOS, iPadOS, macOS), demonstrating the vulnerability's severity and real-world exploitation.

Threat Actors 7

Hacking Team
apt_group 🇮🇹 IT
Tick
apt_group Information theft and espionage 🇨🇳 CN
Infy
apt_group Information theft and espionage 🇮🇷 IR
Operation Red Signature
apt_group Information theft and espionage 🇨🇳 CN
Mana Team
apt_group 🇨🇳 CN
Operation Triangulation
apt_group Information theft and espionage 🇷🇺 RU
Lurk
apt_group Financial crime 🇷🇺 RU

Triage Info

Decided atMar 03, 2026