CVE-2025-31280

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted file may lead to heap corruption.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published: Jul 30, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-312819.1An input validation issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, CVE-2025-312827.2A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrat CVE-2025-312837.2A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administrator CVE-2025-312847.2A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to CVE-2025-312857.2A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator CVE-2025-312869.0An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execute arbitrary code. CVE-2025-31294.8Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access c CVE-2025-31305.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS.Thi CVE-2025-31315.4Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affec CVE-2025-313249.8SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload poten CVE-2025-313255.8Due to a Cross-Site Scripting vulnerability in SAP NetWeaver (ABAP Keyword Documentation), an unauthenticated attacker could inject maliciou CVE-2025-313264.1SAP�BusinessObjects Business�Intelligence Platform (Web Intelligence) is vulnerable to HTML Injection, allowing an attacker with basic user